Edit tour

Windows Analysis Report
V6363OW8Rh.exe

Overview

General Information

Sample name:	V6363OW8Rh.exe renamed because original name is a hash value
Original sample name:	f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947.exe
Analysis ID:	1465434
MD5:	1b5b62e15509efce8bb5379b28a5210b
SHA1:	e647ff934fc92b65344cb115b35c32e3792d36cc
SHA256:	f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947
Tags:	exe
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to capture screen (.Net source)

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

V6363OW8Rh.exe (PID: 1340 cmdline: "C:\Users\user\Desktop\V6363OW8Rh.exe" MD5: 1B5B62E15509EFCE8BB5379B28A5210B)

cmd.exe (PID: 5924 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5328 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

XClient.exe (PID: 2056 cmdline: "C:\Users\user\AppData\Roaming\XClient.exe" MD5: 1B5B62E15509EFCE8BB5379B28A5210B)

XClient.exe (PID: 2812 cmdline: "C:\Users\user\AppData\Roaming\XClient.exe" MD5: 1B5B62E15509EFCE8BB5379B28A5210B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["price-slow.gl.at.ply.gg"], "Port": "28067", "Aes key": "123456789", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
V6363OW8Rh.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
V6363OW8Rh.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfd24:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfdc1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfed6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xef2b:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\XClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\XClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfd24:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfdc1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfed6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xef2b:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfb24:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfbc1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfcd6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xed2b:$cnc4: POST / HTTP/1.1
00000000.00000002.2981859011.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: V6363OW8Rh.exe PID: 1340	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.V6363OW8Rh.exe.e60000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.V6363OW8Rh.exe.e60000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xfd24:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfdc1:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfed6:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xef2b:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\XClient.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\V6363OW8Rh.exe, ProcessId: 1340, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\V6363OW8Rh.exe, ProcessId: 1340, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Snort Signatures

ETPRO TROJAN Win32/XWorm V2 CnC Command - PING Outbound - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:33:46.361784
SID:	2853369
Source Port:	49708
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:34:22.518215
SID:	2852923
Source Port:	49708
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:34:08.236813
SID:	2852923
Source Port:	49709
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:34:04.550316
SID:	2853370
Source Port:	49700
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:33:14.582494
SID:	2853371
Source Port:	49700
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:34:10.018964
SID:	2852923
Source Port:	49710
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - sendPlugin Outbound - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:33:45.579382
SID:	2853376
Source Port:	49700
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Command - Ping Inbound - Source IP: 147.185.221.18 - Destination IP: 192.168.2.6

Timestamp:	07/01/24-16:33:38.196360
SID:	2853372
Source Port:	28067
Destination Port:	49700
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:34:19.065107
SID:	2852923
Source Port:	49713
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:34:12.659041
SID:	2852923
Source Port:	49712
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) - Source IP: 192.168.2.6 - Destination IP: 147.185.221.18

Timestamp:	07/01/24-16:34:21.780689
SID:	2852923
Source Port:	49700
Destination Port:	28067
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 147.185.221.18 - Destination IP: 192.168.2.6

Timestamp:	07/01/24-16:34:22.470923
SID:	2852870
Source Port:	28067
Destination Port:	49700
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - savePlugin Inbound - Source IP: 147.185.221.18 - Destination IP: 192.168.2.6

Timestamp:	07/01/24-16:33:45.837234
SID:	2853377
Source Port:	28067
Destination Port:	49700
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: V6363OW8Rh.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\XClient.exe

Avira: detection malicious, Label: HEUR/AGEN.1305769

Found malware configuration

Source: V6363OW8Rh.exe

Malware Configuration Extractor: Xworm {"C2 url": ["price-slow.gl.at.ply.gg"], "Port": "28067", "Aes key": "123456789", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\XClient.exe

ReversingLabs: Detection: 84%

Multi AV Scanner detection for submitted file

Source: V6363OW8Rh.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\XClient.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: V6363OW8Rh.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: V6363OW8Rh.exe	String decryptor: price-slow.gl.at.ply.gg
Source: V6363OW8Rh.exe	String decryptor: 28067
Source: V6363OW8Rh.exe	String decryptor: 123456789
Source: V6363OW8Rh.exe	String decryptor: <Xwormmm>
Source: V6363OW8Rh.exe	String decryptor: XWorm V5.6
Source: V6363OW8Rh.exe	String decryptor: USB.exe
Source: V6363OW8Rh.exe	String decryptor: %AppData%
Source: V6363OW8Rh.exe	String decryptor: XClient.exe

Source: V6363OW8Rh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: V6363OW8Rh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: g.pdbWi source: V6363OW8Rh.exe, 00000000.00000002.2983062658.000000001C135000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: g.pdbr\V source: V6363OW8Rh.exe, 00000000.00000002.2983062658.000000001C135000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: V6363OW8Rh.exe, 00000000.00000002.2983181180.000000001C185000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Drawing.pdbpdbing.pdbX source: V6363OW8Rh.exe, 00000000.00000002.2983062658.000000001C177000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D8FB4h	0_2_00007FFD348D8916
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D8FC5h	0_2_00007FFD348D8916
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D99E4h	0_2_00007FFD348D8916
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D99F5h	0_2_00007FFD348D8916
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D4692h	0_2_00007FFD348D44CD
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D1FB2h	0_2_00007FFD348D1DED
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D52E4h	0_2_00007FFD348D4A10
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D52F5h	0_2_00007FFD348D4A10
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D3322h	0_2_00007FFD348D3196
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348CF342h	0_2_00007FFD348CF1AC
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D7954h	0_2_00007FFD348D72F9
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D7965h	0_2_00007FFD348D72F9
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D8584h	0_2_00007FFD348D7EFD
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D8595h	0_2_00007FFD348D7EFD
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D1042h	0_2_00007FFD348D0E7D
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D5EB4h	0_2_00007FFD348CC3F8
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 4x nop then jmp 00007FFD348D5EB4h	0_2_00007FFD348CC3F8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2853371 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.6:49700 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 147.185.221.18:28067 -> 192.168.2.6:49700
Source: Traffic	Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.6:49700 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2853372 ETPRO TROJAN Win32/XWorm CnC Command - Ping Inbound 147.185.221.18:28067 -> 192.168.2.6:49700
Source: Traffic	Snort IDS: 2853376 ETPRO TROJAN Win32/XWorm V3 CnC Command - sendPlugin Outbound 192.168.2.6:49700 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2853377 ETPRO TROJAN Win32/XWorm V3 CnC Command - savePlugin Inbound 147.185.221.18:28067 -> 192.168.2.6:49700
Source: Traffic	Snort IDS: 2853369 ETPRO TROJAN Win32/XWorm V2 CnC Command - PING Outbound 192.168.2.6:49708 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.6:49708 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.6:49709 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.6:49710 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.6:49712 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2852923 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) 192.168.2.6:49713 -> 147.185.221.18:28067
Source: Traffic	Snort IDS: 2853370 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.6:49700 -> 147.185.221.18:28067

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: price-slow.gl.at.ply.gg

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.185.221.18 ports 0,28067,2,6,7,8

Source: global traffic

TCP traffic: 192.168.2.6:49700 -> 147.185.221.18:28067

Source: Joe Sandbox View

IP Address: 147.185.221.18 147.185.221.18

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: price-slow.gl.at.ply.gg

Source: V6363OW8Rh.exe, 00000000.00000002.2981859011.00000000031D1000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.V6363OW8Rh.exe.16d0000.0.raw.unpack, RemoteDesktop.cs

.Net Code: GetScreen

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: 01 00 00 00			Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: 00 00 00 00			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: V6363OW8Rh.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.V6363OW8Rh.exe.e60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348D8916	0_2_00007FFD348D8916
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348D04D8	0_2_00007FFD348D04D8
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C9D72	0_2_00007FFD348C9D72
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C1198	0_2_00007FFD348C1198
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348CE30A	0_2_00007FFD348CE30A
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C1689	0_2_00007FFD348C1689
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C8FF6	0_2_00007FFD348C8FF6
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C1408	0_2_00007FFD348C1408
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C2839	0_2_00007FFD348C2839
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C5888	0_2_00007FFD348C5888
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C68AD	0_2_00007FFD348C68AD
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C1DFD	0_2_00007FFD348C1DFD
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C5310	0_2_00007FFD348C5310
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348CD680	0_2_00007FFD348CD680
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348C8AC9	0_2_00007FFD348C8AC9
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348CC3F8	0_2_00007FFD348CC3F8
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Code function: 0_2_00007FFD348CD680	0_2_00007FFD348CD680
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFD34881198	2_2_00007FFD34881198
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFD34881689	2_2_00007FFD34881689
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 2_2_00007FFD34881DFD	2_2_00007FFD34881DFD
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FFD34891198	4_2_00007FFD34891198
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FFD34891689	4_2_00007FFD34891689
Source: C:\Users\user\AppData\Roaming\XClient.exe	Code function: 4_2_00007FFD34891DFD	4_2_00007FFD34891DFD

Source: V6363OW8Rh.exe, 00000000.00000002.2981622876.00000000016D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRemoteDesktop.dll< vs V6363OW8Rh.exe
Source: V6363OW8Rh.exe, 00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs V6363OW8Rh.exe
Source: V6363OW8Rh.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs V6363OW8Rh.exe

Source: V6363OW8Rh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: V6363OW8Rh.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.V6363OW8Rh.exe.e60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: V6363OW8Rh.exe, fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: V6363OW8Rh.exe, fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: V6363OW8Rh.exe, UDntxBBw0PgLwVxatiCGf4TjxZnAhmFLlDdp6sB0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: XClient.exe.0.dr, UDntxBBw0PgLwVxatiCGf4TjxZnAhmFLlDdp6sB0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.V6363OW8Rh.exe.16d0000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.V6363OW8Rh.exe.16d0000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: XClient.exe.0.dr, FNXnrLjeumdsOaobtdN6BXk32UIpBpAxlPwiGTL2YtgOKFbrHq7Hjda.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: XClient.exe.0.dr, FNXnrLjeumdsOaobtdN6BXk32UIpBpAxlPwiGTL2YtgOKFbrHq7Hjda.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: V6363OW8Rh.exe, FNXnrLjeumdsOaobtdN6BXk32UIpBpAxlPwiGTL2YtgOKFbrHq7Hjda.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: V6363OW8Rh.exe, FNXnrLjeumdsOaobtdN6BXk32UIpBpAxlPwiGTL2YtgOKFbrHq7Hjda.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/6@1/1

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File created: C:\Users\user\AppData\Roaming\XClient.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\XClient.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Mutant created: \Sessions\1\BaseNamedObjects\0LEyuKQ1EqG8U6vU
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4092:120:WilError_03

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File created: C:\Users\user\AppData\Local\Temp\tmpAD99.tmp

Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat""

Source: V6363OW8Rh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: V6363OW8Rh.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: V6363OW8Rh.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File read: C:\Users\user\Desktop\V6363OW8Rh.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\V6363OW8Rh.exe "C:\Users\user\Desktop\V6363OW8Rh.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\XClient.exe "C:\Users\user\AppData\Roaming\XClient.exe"
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: XClient.lnk.0.dr

LNK file: ..\..\..\..\..\XClient.exe

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: V6363OW8Rh.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: V6363OW8Rh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: g.pdbWi source: V6363OW8Rh.exe, 00000000.00000002.2983062658.000000001C135000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: g.pdbr\V source: V6363OW8Rh.exe, 00000000.00000002.2983062658.000000001C135000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: V6363OW8Rh.exe, 00000000.00000002.2983181180.000000001C185000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Drawing.pdbpdbing.pdbX source: V6363OW8Rh.exe, 00000000.00000002.2983062658.000000001C177000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: V6363OW8Rh.exe, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.fABb5Osdy1RYoizEB5ZaS7KQqfJGcQ8y8XEzlcCEXDVpoiwcb9zLxED,yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.ct3hJPBA5E8Ntk5DizpcCmZ9glqF1t6NrGezA84yq2ZN6Y83up0BOeF,yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef._0jWuPJUAWhtgChImRsf1roFep67DC5UMF6tuU3DwT6ts2DWWqJGv3Nx,yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.Czgx8z4MClDgOaPs8oiRzaIB00ATVglr975E77fuczvtbKIffl2zysh,fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.kaY3czeAjKKVDFSXfkI1cpH7eBJIdD1jUY8Qds2E()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: V6363OW8Rh.exe, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{yPX1Z4SGoYytmXTRoyHFXP4XAitfdJaGDMDvAjUj[2],fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.SIarGOqmXCzHOeOzIm8BKuC3MIQvMQkjrcCgczrW(Convert.FromBase64String(yPX1Z4SGoYytmXTRoyHFXP4XAitfdJaGDMDvAjUj[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.fABb5Osdy1RYoizEB5ZaS7KQqfJGcQ8y8XEzlcCEXDVpoiwcb9zLxED,yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.ct3hJPBA5E8Ntk5DizpcCmZ9glqF1t6NrGezA84yq2ZN6Y83up0BOeF,yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef._0jWuPJUAWhtgChImRsf1roFep67DC5UMF6tuU3DwT6ts2DWWqJGv3Nx,yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.Czgx8z4MClDgOaPs8oiRzaIB00ATVglr975E77fuczvtbKIffl2zysh,fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.kaY3czeAjKKVDFSXfkI1cpH7eBJIdD1jUY8Qds2E()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: XClient.exe.0.dr, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{yPX1Z4SGoYytmXTRoyHFXP4XAitfdJaGDMDvAjUj[2],fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.SIarGOqmXCzHOeOzIm8BKuC3MIQvMQkjrcCgczrW(Convert.FromBase64String(yPX1Z4SGoYytmXTRoyHFXP4XAitfdJaGDMDvAjUj[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: V6363OW8Rh.exe, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: ZVZPLW1jM3kU2Vjm3OSZ20ektUnahqCpJ8Mbqnuh System.AppDomain.Load(byte[])
Source: V6363OW8Rh.exe, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: XyeECVT7Xa7VsQPXBcg7CMo2yPTHeytXP0bd7FAX System.AppDomain.Load(byte[])
Source: V6363OW8Rh.exe, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: XyeECVT7Xa7VsQPXBcg7CMo2yPTHeytXP0bd7FAX
Source: XClient.exe.0.dr, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: ZVZPLW1jM3kU2Vjm3OSZ20ektUnahqCpJ8Mbqnuh System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: XyeECVT7Xa7VsQPXBcg7CMo2yPTHeytXP0bd7FAX System.AppDomain.Load(byte[])
Source: XClient.exe.0.dr, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	.Net Code: XyeECVT7Xa7VsQPXBcg7CMo2yPTHeytXP0bd7FAX

Source: V6363OW8Rh.exe, yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.cs	High entropy of concatenated method names: 'TR50E7dnUfA8CputxRRwZwMRUWcVSEnOTQRrzLKSb6ZXNfeIH0iIngj7hC2Ab6bFLTAsFER8Q', '_3RQRwzjEjUxQtEoNfbGVDLxcMf3gWlSfMJi8Szk3SVDAdDyDNRqPF28cnB0S4QoSZTSs8Jmoa', 'o2Q8AvfDtZeeyp1gq5pxPQs34I8bK08DISsroDJsdGckFycob8HFdAVKJcTndAExrHDgAriSQ', 'vwmRxq2FY3NGa5ugF6iqhs1mbdy3dnojHThg5RTvZ2ipF1ilyjPArqoP68XLF47vtNSwhfe2l'
Source: V6363OW8Rh.exe, gAbl2FvV7nWSlLX9t8U1vyRvMXgeeDKVe2xRy75q.cs	High entropy of concatenated method names: '_1jyF8m9jLkFgZFnyICglia3heyxaoap14FkgRk2c', 'dQwBqv4Ftb1H4I93SGstVn253VJbbmNDpAnVjEXv', '_7T5N5ZJNPAKO4ECE58MthOzmqAwwCTgoJWOVS36l', 'npqIyfCuJzqPlvf1DYBvdSz7HNvUd6mgn', 'iVNGbrlCtGWrWsYOKrHm1cLZ4mh31MeRZ', '_00mzE5FC8Pzeq645oeiel2B6a30kMetty', 'Gr49HUp45UIFSP6ZmD5U8Z1WsKrpqDLPv', 'XriIvKp6gXHksiRMnuuGH55ONEmqbt6bL', 'cyF4CP4YryomrHoxoXOaIGYvbpYqBbfdm', 'W0v2gehVHdQXvzCkiHOO2WHcWrUYjiqir'
Source: V6363OW8Rh.exe, bmiFdtTi9xjc1iEvR4JppooiyqC61nUncg4Ry1rd6AFWuDGu4VGaopI.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'yFSzCDBvwcZjOztbxZBMGGhZ3FLnpFw8HLVP3zZrRUW1SJoYuPo9x15xTx0LhTKpC4G5qnHII', '_6wpa0Nz1MJh2p48DCqSVLenjVCfIGPEq7ZpW90Rd1pVUAwZXAIgxgvfmGaNBpPkHgUZJsTbck', 'tRO6OktaA7Bq13JYfdv4RLBfPC9MlZidp5BAohWEY1zPqatFO9TXo3fmFHDjbOdNQ1K5gDEnl', 'Dxl0iZn76RUxds12FdEBXCDe1vv5yS5Dx9LYGpKrtHtlLitr7vdGbgk1pikFUFcYiS2eL7luj'
Source: V6363OW8Rh.exe, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	High entropy of concatenated method names: 'gjZFLTEKClESANuDqrtz1XPa0jQqi6FusTxAzUNa', 'ZVZPLW1jM3kU2Vjm3OSZ20ektUnahqCpJ8Mbqnuh', 'XZlnF5tl4mnBD5R0TQahwzMmtWu7CcS7PNqFWYkK', 'xiOZvAdUNdftXOy12LbixYXIZK7ZYwipMBpm38jc', 'N7mGblIV68hPfhTZLk7E1HzpyLgFoHXbNtLEtr38', 'JiJx8WMF0TsLZ2PxsLfJuuo5i1agqmKTjpMimI8s', 'fMPNLx2UlsziTYkls51sLR69BqFO5Blonwj01ded', '_3OMywUdjCjtAUCs56ajQAiG8JLbzp9NiE0e6DILF', 'WMejGyyRiCELUq5HvaN8oWqr2jRI8sp022zusbNZ', '_3Un9XouINKxVJcsZ3k7kHf0nT2ScQoksXFImMOeM'
Source: V6363OW8Rh.exe, puNbzn4AUQ5JNVI5KHqKXanWdOynMJbw7z9vXTrD.cs	High entropy of concatenated method names: 'IYI0So8IrjwD1SnmCKjtTASt6IT5EZSSXmLYelel', 'Hl4XvtwsVgHz7B2wrYHUGNQkjKQ3XgUsjxlqIJwYJghZrZCdZcZeQ1Dg8yDJQbpUiPPNco6ekFijAD20IMjNOTUxYX', 'Ggs8RSMKyH5B0kKqIBaGo9LsCtAek1HCyjeMHktHdIzB4k8WadZbcOWQ3p8ZTd90rsG8k74XvWaU8VMx3DHK3A7Qte', 'ce6AQVOzczqb0fs4BDPmq6usZwI3xnO0CvFfFG6NpHMaegoKsLcn5ZKS6vF5ZTs44CUQTEt5sxExPMwcKojHoedMfT', 'pVjiADppAnwfYf3ii1Y4ypEvJVlomYunHm6JpMj5cIvfn6O1041ug5GeXmnNowZ5IM8XWTREbLVXOd30uMtFVY9oaS'
Source: V6363OW8Rh.exe, KaJuqTRSnBSCV3kmwUtI5HV1MSIX6DUgNRdORXE1XekWldTMz44puQX.cs	High entropy of concatenated method names: 'JHq0eXwp7Mwul12pYtAMITitLVvAkgt798MqTe29j9PaHcbA9bEh2BH', 'FyRkXEE1HwocjDDsD3wyAqjM4qFHmLTKUteo1w4obsM47y3bmn0NEvk', 'SsRY7QV0gUBowNLZrOgvPWlJOtVVShZR1i1o1IbArze41GU1cgplhzk', 'faAh770hCH9eHKnE54bS7wjuC0yDgDCZ2J8Ac1oDqfSphI3lm132Duo2b0Fc8drIN0tSFu8oD', 'E5xvMFwwUrNvpk2yOTWdtlfgtIBPVLCdaqugLr6TJMnbNBAYveEIzMLb3ZM8UNqQjhTgW07fR', 'T6BwhsA56qA7jS5Oc6qggCMSwoyqAAptRJkbblYtU3Gk026hO5oNXhYl0NOov6r3qU2MGaKiV', 'stlg9xdi2mkmmA4Qj3uqc5EZ8voiuPQErZ6iuE6aCDImHKH1ESflBlCRRmqfmLL0bipoNtYlp', 't5Agv87ZaBQ0IK22KW3ZJggtYC9t11wzJOLYLINTWQjuY8vTOCoSAqBUqKYAIvvD7EnosbT0b', 'HmDaeSfwZnxIPRZ2cVY5dqTm9un1WULm5GfBj35cKoM3dqaoEjOq6I4NBf', 'EjmbHNHdix5F0OsEK6c6BYhJkA7uRJo7oWYD9zCqRfewzrBdICbjzfu0lB'
Source: V6363OW8Rh.exe, UYNhh4ynO44BZXpn63M0nNsEh42AdcGawaBqC3QZ.cs	High entropy of concatenated method names: '_0a5Ca9vjJdSLY7TpZER9l7xj47iVggyCOHcKRF27', 'FUUFjxNiJm1PywcOhA3Hcpe30fnKovu4TIwzI4GD', 'N7Cb12KFJawTZjYeKB9PraoyJ80HKO9o90m0WHax', 'w5UWwGritQRzBgSSNE84erEhuAxm8EB4gXq93fvq19HtHMYKORaKoKzp8Ql2DF6TiiZC71Mp3owqNdEc8R00Rw6vNF', 'MOfYTtdqRVZm46UDx7D44gQp3UddcQgpS2Jxsd0EOD1NwRsSLE0Sb7O7Vz9wtZybXb6LfiqjELdPn8rm8RZzralg1h', 'S68QV0KCX12MI0ao1WNkcmgraDIbtdIOgdmgQXSuMwKlT2Ym9v4XcIkgGoXRUrj5JLgMxKu9blIFrg6bkqmSfdGThn', 'HGMU8kXR0WY2B7lTDZig9n80w0pyN2PYEYvw7PjRUPDaY5CeiFcN2IJryJAWa7obUhg58ETmy89FcXbDCYEmmOYd5Y', '_76kgNQryF2wp2s5ZN7CxqQyEp2AfOmErUNA04lTO9O64MXavikYyQn8BDkxHoqA6ngYbKHIiQ8ayGybLrw2XMnuZAH', 'M8aCLIj9sBIdbs1WmnTtbZoY4XseAkACdfE0tcH65mGlr0lWPrxqyAdRnNsCEW66bIo9pt2IbJLNiooi63irTpjK0L', 'FnHo72qcp2nLvwUEL2ZtzLnkxxVKzUzkccfPUIINa95iVIE1YielQyVTBeFElizDAy8vYLBuzw7d2BWDWQogYdvklq'
Source: V6363OW8Rh.exe, GwpL9rNwFWBYv2cg2WC1jt7LwyA7s9Qf4Q0IckIB.cs	High entropy of concatenated method names: 'QuclBBRVFIWJjBJYHvnFOTW1RySZsySufgviuMd3', 'aPcI4npoNx6qs6XoaxBOEIGGBBF1xj2PT8OXeDYC', 'L9no6VilIEL5n54UHYMtAgOj49bzvSDY2gVSIllC', 'jQLDZ0RrTlyRHKZXIbG6ru0conaQgiTkkh0ceKRD', 'jjCt1Wt389TbkF64xJ6dPXTb9uIkeVCZ19BLG1ujOboDNlQd0Tt84ClWr1EoDH5pXEtOGOiy4FBsdJmT1oQ7f9nFBw', 'J9CbapsN6TXF9vJc20Z0rVISzMAYiBBCx8q5t2K60Ds3Rg6o8tXJOJWJtyMKm6iqw4bvrrcgWeexpYtPMbauAE3nmB', 'Rs37Dn6z0eQvZNauV9Rji3xIPtmPfMhYR6iplrIL0IQa6hUaAHk82dO7lsnuWe0OoIcysSzpMLkFCN9yKxdek1m7nt', 'ttn31KjuIhrEwkH58LGdeNiboHNqSNNI9j2n6egV8ZHLVMC7sp7Eq387MIwTCBDLcj0RKA3auJdlut0pjuappwVqYQ', 'ZuFPJVj3TY1CooJk9474SDOWjwQjCJKmcIYYYRMnZpJSDDgGwv9Gbk1K28mFhLbJS3yLre7hUrTFkOtXsn7RApZoxV', 'RDyAmC5SfnbcilSTgz1zr4MSXZ3gBN4SUPNmH146FXKixZNs9lN9IocQvI3No8PXceEDKLOWI9ncCMHnc3Jz9oTvjT'
Source: V6363OW8Rh.exe, fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.cs	High entropy of concatenated method names: 'egUfB0IbFHVnPYn3qWJ1VbSf5qE0jSST71H0tguf', 'j8gsn47Bet05zWM8aDJpYTnXZ2k11Qf4BYE0VXnt', 'BjfE2Jt3u8iHdORd3fnz7yNUeoDOpsyLIre0FpZX', 'y2Ugk7ny07drVxjseOOCvsYdvi70lm8KQ99WVCcY', 'bJutu7gbh65vfHxuMH9K95G26fNIs9fgnJWrctMi', 'LkOXp0V5J82O2rFY56g27tPqqCuHfewIoxZVe4uX', 'DWa5mUdPgGxUhh09qLJzeNOV5H59if1CvQDBynDb', 'gb6mNmOCBC955UcSsno9nXchBnoSqy2xww7Vba1l', '_9ln0uM9XgKPUyXKPxIPS3tBwFERVnGN8ZnkvP3PD', 'ASqXB4h4YG0qG4saxpefmV2cf7UTRGLCSH2EMRT1'
Source: V6363OW8Rh.exe, UDntxBBw0PgLwVxatiCGf4TjxZnAhmFLlDdp6sB0.cs	High entropy of concatenated method names: 'XdMYBxBbDwcDGdGhEuPfDks5xVTNa7q9NCx1aWOy', 'J0eihecGH4Uwd6DozpVxlMtLKrbMQhhIv4lNpifZzo5aikdvm2iVurLZWaNn0jvQ6kediYwPdwUyBYcsIvXV2s3LwY', 'BHPl5yCiF6QhZskwBS9VjXkEg35mqAPni3rnZuDXQMVdeyKEj5cwR0f1ten0VHpjyhWs5tX4ahnunQZcPJ0BNGilRm', 'Go3Yeocyrf248oZHxfYXvLzapxfbRuw5H7tnnEqy7qq9PIXuU3E4Yj7obQ3Dj0FJf3atuU9VdfhPmAan4ISvJtDwqS', 'PDY6T4G9F4KYxIQmRKZdJbKFXxOBJjfmsOwNhe3ym39RVvfRxuBphuUWZS2btYDoROJPDvn8JMH8dyP8lZSIszXqrW'
Source: V6363OW8Rh.exe, FNXnrLjeumdsOaobtdN6BXk32UIpBpAxlPwiGTL2YtgOKFbrHq7Hjda.cs	High entropy of concatenated method names: '_5Ojw6iYjR7PvvrqvfAUCYbSxK63DwvGN4Pe6UpZWwj5OPaJvht88z4Y', 'hBA37YJU9VVP8lDsVkHrJEVhPg9kczXrTqnuD7Q0g5FgNttRuOBM2jm', 'BzOTG7v1I3LtTz390GAbVpnvVaoOrqbBgCm5NLaaJNpNpREa40pPczL', 'kUvWvl4xvw5toLlvxH5kx3i3qjQSmASW8F1dVVHYPpXsguLmDIRUiR5', 'wUOFthQwExjdfvWF3aRPdhabCzEwJPXlJx83b4hskAmK4jPGpXc8YIZ', 'ylOOpV14fxqCrUCZr57UJZ1p847mEqu2zHCPwXc6ktoEQ6XZfGm3bIj', 'ikjsU7CrDAAvvWtn3ZNIZ7U4ig6CfpMPGnCFlyrJqBw0I3NnxIthBgs', 'V2M6jJOpIo0W92CqtfF9XuprpoA2Yw807dR6UPecYeSvPtDklsMCaCi', 'gDoJUskVYs2UOma76H1ezINpDYUSBYHNrcZVldyS4BAmfzun19OF3B6', 'A777DaakUGm1OvTP8A3SdXEDkc31txVHhbcNdJzOTDpAnUPUw9yk9HU'
Source: XClient.exe.0.dr, yIkQESIgI9MiMiB3kuu7HFMoUGGaRYuLFizjcOYZN8HhKAIZ6TKtHef.cs	High entropy of concatenated method names: 'TR50E7dnUfA8CputxRRwZwMRUWcVSEnOTQRrzLKSb6ZXNfeIH0iIngj7hC2Ab6bFLTAsFER8Q', '_3RQRwzjEjUxQtEoNfbGVDLxcMf3gWlSfMJi8Szk3SVDAdDyDNRqPF28cnB0S4QoSZTSs8Jmoa', 'o2Q8AvfDtZeeyp1gq5pxPQs34I8bK08DISsroDJsdGckFycob8HFdAVKJcTndAExrHDgAriSQ', 'vwmRxq2FY3NGa5ugF6iqhs1mbdy3dnojHThg5RTvZ2ipF1ilyjPArqoP68XLF47vtNSwhfe2l'
Source: XClient.exe.0.dr, gAbl2FvV7nWSlLX9t8U1vyRvMXgeeDKVe2xRy75q.cs	High entropy of concatenated method names: '_1jyF8m9jLkFgZFnyICglia3heyxaoap14FkgRk2c', 'dQwBqv4Ftb1H4I93SGstVn253VJbbmNDpAnVjEXv', '_7T5N5ZJNPAKO4ECE58MthOzmqAwwCTgoJWOVS36l', 'npqIyfCuJzqPlvf1DYBvdSz7HNvUd6mgn', 'iVNGbrlCtGWrWsYOKrHm1cLZ4mh31MeRZ', '_00mzE5FC8Pzeq645oeiel2B6a30kMetty', 'Gr49HUp45UIFSP6ZmD5U8Z1WsKrpqDLPv', 'XriIvKp6gXHksiRMnuuGH55ONEmqbt6bL', 'cyF4CP4YryomrHoxoXOaIGYvbpYqBbfdm', 'W0v2gehVHdQXvzCkiHOO2WHcWrUYjiqir'
Source: XClient.exe.0.dr, bmiFdtTi9xjc1iEvR4JppooiyqC61nUncg4Ry1rd6AFWuDGu4VGaopI.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'yFSzCDBvwcZjOztbxZBMGGhZ3FLnpFw8HLVP3zZrRUW1SJoYuPo9x15xTx0LhTKpC4G5qnHII', '_6wpa0Nz1MJh2p48DCqSVLenjVCfIGPEq7ZpW90Rd1pVUAwZXAIgxgvfmGaNBpPkHgUZJsTbck', 'tRO6OktaA7Bq13JYfdv4RLBfPC9MlZidp5BAohWEY1zPqatFO9TXo3fmFHDjbOdNQ1K5gDEnl', 'Dxl0iZn76RUxds12FdEBXCDe1vv5yS5Dx9LYGpKrtHtlLitr7vdGbgk1pikFUFcYiS2eL7luj'
Source: XClient.exe.0.dr, kb5iJ51IX11W3m6ZYskpvSESZEX0NftR31uZbfED.cs	High entropy of concatenated method names: 'gjZFLTEKClESANuDqrtz1XPa0jQqi6FusTxAzUNa', 'ZVZPLW1jM3kU2Vjm3OSZ20ektUnahqCpJ8Mbqnuh', 'XZlnF5tl4mnBD5R0TQahwzMmtWu7CcS7PNqFWYkK', 'xiOZvAdUNdftXOy12LbixYXIZK7ZYwipMBpm38jc', 'N7mGblIV68hPfhTZLk7E1HzpyLgFoHXbNtLEtr38', 'JiJx8WMF0TsLZ2PxsLfJuuo5i1agqmKTjpMimI8s', 'fMPNLx2UlsziTYkls51sLR69BqFO5Blonwj01ded', '_3OMywUdjCjtAUCs56ajQAiG8JLbzp9NiE0e6DILF', 'WMejGyyRiCELUq5HvaN8oWqr2jRI8sp022zusbNZ', '_3Un9XouINKxVJcsZ3k7kHf0nT2ScQoksXFImMOeM'
Source: XClient.exe.0.dr, puNbzn4AUQ5JNVI5KHqKXanWdOynMJbw7z9vXTrD.cs	High entropy of concatenated method names: 'IYI0So8IrjwD1SnmCKjtTASt6IT5EZSSXmLYelel', 'Hl4XvtwsVgHz7B2wrYHUGNQkjKQ3XgUsjxlqIJwYJghZrZCdZcZeQ1Dg8yDJQbpUiPPNco6ekFijAD20IMjNOTUxYX', 'Ggs8RSMKyH5B0kKqIBaGo9LsCtAek1HCyjeMHktHdIzB4k8WadZbcOWQ3p8ZTd90rsG8k74XvWaU8VMx3DHK3A7Qte', 'ce6AQVOzczqb0fs4BDPmq6usZwI3xnO0CvFfFG6NpHMaegoKsLcn5ZKS6vF5ZTs44CUQTEt5sxExPMwcKojHoedMfT', 'pVjiADppAnwfYf3ii1Y4ypEvJVlomYunHm6JpMj5cIvfn6O1041ug5GeXmnNowZ5IM8XWTREbLVXOd30uMtFVY9oaS'
Source: XClient.exe.0.dr, KaJuqTRSnBSCV3kmwUtI5HV1MSIX6DUgNRdORXE1XekWldTMz44puQX.cs	High entropy of concatenated method names: 'JHq0eXwp7Mwul12pYtAMITitLVvAkgt798MqTe29j9PaHcbA9bEh2BH', 'FyRkXEE1HwocjDDsD3wyAqjM4qFHmLTKUteo1w4obsM47y3bmn0NEvk', 'SsRY7QV0gUBowNLZrOgvPWlJOtVVShZR1i1o1IbArze41GU1cgplhzk', 'faAh770hCH9eHKnE54bS7wjuC0yDgDCZ2J8Ac1oDqfSphI3lm132Duo2b0Fc8drIN0tSFu8oD', 'E5xvMFwwUrNvpk2yOTWdtlfgtIBPVLCdaqugLr6TJMnbNBAYveEIzMLb3ZM8UNqQjhTgW07fR', 'T6BwhsA56qA7jS5Oc6qggCMSwoyqAAptRJkbblYtU3Gk026hO5oNXhYl0NOov6r3qU2MGaKiV', 'stlg9xdi2mkmmA4Qj3uqc5EZ8voiuPQErZ6iuE6aCDImHKH1ESflBlCRRmqfmLL0bipoNtYlp', 't5Agv87ZaBQ0IK22KW3ZJggtYC9t11wzJOLYLINTWQjuY8vTOCoSAqBUqKYAIvvD7EnosbT0b', 'HmDaeSfwZnxIPRZ2cVY5dqTm9un1WULm5GfBj35cKoM3dqaoEjOq6I4NBf', 'EjmbHNHdix5F0OsEK6c6BYhJkA7uRJo7oWYD9zCqRfewzrBdICbjzfu0lB'
Source: XClient.exe.0.dr, UYNhh4ynO44BZXpn63M0nNsEh42AdcGawaBqC3QZ.cs	High entropy of concatenated method names: '_0a5Ca9vjJdSLY7TpZER9l7xj47iVggyCOHcKRF27', 'FUUFjxNiJm1PywcOhA3Hcpe30fnKovu4TIwzI4GD', 'N7Cb12KFJawTZjYeKB9PraoyJ80HKO9o90m0WHax', 'w5UWwGritQRzBgSSNE84erEhuAxm8EB4gXq93fvq19HtHMYKORaKoKzp8Ql2DF6TiiZC71Mp3owqNdEc8R00Rw6vNF', 'MOfYTtdqRVZm46UDx7D44gQp3UddcQgpS2Jxsd0EOD1NwRsSLE0Sb7O7Vz9wtZybXb6LfiqjELdPn8rm8RZzralg1h', 'S68QV0KCX12MI0ao1WNkcmgraDIbtdIOgdmgQXSuMwKlT2Ym9v4XcIkgGoXRUrj5JLgMxKu9blIFrg6bkqmSfdGThn', 'HGMU8kXR0WY2B7lTDZig9n80w0pyN2PYEYvw7PjRUPDaY5CeiFcN2IJryJAWa7obUhg58ETmy89FcXbDCYEmmOYd5Y', '_76kgNQryF2wp2s5ZN7CxqQyEp2AfOmErUNA04lTO9O64MXavikYyQn8BDkxHoqA6ngYbKHIiQ8ayGybLrw2XMnuZAH', 'M8aCLIj9sBIdbs1WmnTtbZoY4XseAkACdfE0tcH65mGlr0lWPrxqyAdRnNsCEW66bIo9pt2IbJLNiooi63irTpjK0L', 'FnHo72qcp2nLvwUEL2ZtzLnkxxVKzUzkccfPUIINa95iVIE1YielQyVTBeFElizDAy8vYLBuzw7d2BWDWQogYdvklq'
Source: XClient.exe.0.dr, GwpL9rNwFWBYv2cg2WC1jt7LwyA7s9Qf4Q0IckIB.cs	High entropy of concatenated method names: 'QuclBBRVFIWJjBJYHvnFOTW1RySZsySufgviuMd3', 'aPcI4npoNx6qs6XoaxBOEIGGBBF1xj2PT8OXeDYC', 'L9no6VilIEL5n54UHYMtAgOj49bzvSDY2gVSIllC', 'jQLDZ0RrTlyRHKZXIbG6ru0conaQgiTkkh0ceKRD', 'jjCt1Wt389TbkF64xJ6dPXTb9uIkeVCZ19BLG1ujOboDNlQd0Tt84ClWr1EoDH5pXEtOGOiy4FBsdJmT1oQ7f9nFBw', 'J9CbapsN6TXF9vJc20Z0rVISzMAYiBBCx8q5t2K60Ds3Rg6o8tXJOJWJtyMKm6iqw4bvrrcgWeexpYtPMbauAE3nmB', 'Rs37Dn6z0eQvZNauV9Rji3xIPtmPfMhYR6iplrIL0IQa6hUaAHk82dO7lsnuWe0OoIcysSzpMLkFCN9yKxdek1m7nt', 'ttn31KjuIhrEwkH58LGdeNiboHNqSNNI9j2n6egV8ZHLVMC7sp7Eq387MIwTCBDLcj0RKA3auJdlut0pjuappwVqYQ', 'ZuFPJVj3TY1CooJk9474SDOWjwQjCJKmcIYYYRMnZpJSDDgGwv9Gbk1K28mFhLbJS3yLre7hUrTFkOtXsn7RApZoxV', 'RDyAmC5SfnbcilSTgz1zr4MSXZ3gBN4SUPNmH146FXKixZNs9lN9IocQvI3No8PXceEDKLOWI9ncCMHnc3Jz9oTvjT'
Source: XClient.exe.0.dr, fL4JYPx9VcnUwqCcsrDkoS17gMbOS6yiCf166use.cs	High entropy of concatenated method names: 'egUfB0IbFHVnPYn3qWJ1VbSf5qE0jSST71H0tguf', 'j8gsn47Bet05zWM8aDJpYTnXZ2k11Qf4BYE0VXnt', 'BjfE2Jt3u8iHdORd3fnz7yNUeoDOpsyLIre0FpZX', 'y2Ugk7ny07drVxjseOOCvsYdvi70lm8KQ99WVCcY', 'bJutu7gbh65vfHxuMH9K95G26fNIs9fgnJWrctMi', 'LkOXp0V5J82O2rFY56g27tPqqCuHfewIoxZVe4uX', 'DWa5mUdPgGxUhh09qLJzeNOV5H59if1CvQDBynDb', 'gb6mNmOCBC955UcSsno9nXchBnoSqy2xww7Vba1l', '_9ln0uM9XgKPUyXKPxIPS3tBwFERVnGN8ZnkvP3PD', 'ASqXB4h4YG0qG4saxpefmV2cf7UTRGLCSH2EMRT1'
Source: XClient.exe.0.dr, UDntxBBw0PgLwVxatiCGf4TjxZnAhmFLlDdp6sB0.cs	High entropy of concatenated method names: 'XdMYBxBbDwcDGdGhEuPfDks5xVTNa7q9NCx1aWOy', 'J0eihecGH4Uwd6DozpVxlMtLKrbMQhhIv4lNpifZzo5aikdvm2iVurLZWaNn0jvQ6kediYwPdwUyBYcsIvXV2s3LwY', 'BHPl5yCiF6QhZskwBS9VjXkEg35mqAPni3rnZuDXQMVdeyKEj5cwR0f1ten0VHpjyhWs5tX4ahnunQZcPJ0BNGilRm', 'Go3Yeocyrf248oZHxfYXvLzapxfbRuw5H7tnnEqy7qq9PIXuU3E4Yj7obQ3Dj0FJf3atuU9VdfhPmAan4ISvJtDwqS', 'PDY6T4G9F4KYxIQmRKZdJbKFXxOBJjfmsOwNhe3ym39RVvfRxuBphuUWZS2btYDoROJPDvn8JMH8dyP8lZSIszXqrW'
Source: XClient.exe.0.dr, FNXnrLjeumdsOaobtdN6BXk32UIpBpAxlPwiGTL2YtgOKFbrHq7Hjda.cs	High entropy of concatenated method names: '_5Ojw6iYjR7PvvrqvfAUCYbSxK63DwvGN4Pe6UpZWwj5OPaJvht88z4Y', 'hBA37YJU9VVP8lDsVkHrJEVhPg9kczXrTqnuD7Q0g5FgNttRuOBM2jm', 'BzOTG7v1I3LtTz390GAbVpnvVaoOrqbBgCm5NLaaJNpNpREa40pPczL', 'kUvWvl4xvw5toLlvxH5kx3i3qjQSmASW8F1dVVHYPpXsguLmDIRUiR5', 'wUOFthQwExjdfvWF3aRPdhabCzEwJPXlJx83b4hskAmK4jPGpXc8YIZ', 'ylOOpV14fxqCrUCZr57UJZ1p847mEqu2zHCPwXc6ktoEQ6XZfGm3bIj', 'ikjsU7CrDAAvvWtn3ZNIZ7U4ig6CfpMPGnCFlyrJqBw0I3NnxIthBgs', 'V2M6jJOpIo0W92CqtfF9XuprpoA2Yw807dR6UPecYeSvPtDklsMCaCi', 'gDoJUskVYs2UOma76H1ezINpDYUSBYHNrcZVldyS4BAmfzun19OF3B6', 'A777DaakUGm1OvTP8A3SdXEDkc31txVHhbcNdJzOTDpAnUPUw9yk9HU'

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File created: C:\Users\user\AppData\Roaming\XClient.exe

Jump to dropped file

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient			Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XClient			Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\F89E52B49AA08D9BF38E CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34

Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Memory allocated: 14B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Memory allocated: 1B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1A490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Memory allocated: 1A7C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Window / User API: threadDelayed 1720			Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Window / User API: threadDelayed 8117			Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe TID: 6756	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 3496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe TID: 4068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: V6363OW8Rh.exe, 00000000.00000002.2983062658.000000001C135000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat""			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3			Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Queries volume information: C:\Users\user\Desktop\V6363OW8Rh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\V6363OW8Rh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\XClient.exe	Queries volume information: C:\Users\user\AppData\Roaming\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\V6363OW8Rh.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: V6363OW8Rh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.V6363OW8Rh.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2981859011.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V6363OW8Rh.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: V6363OW8Rh.exe, type: SAMPLE
Source: Yara match	File source: 0.0.V6363OW8Rh.exe.e60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2981859011.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V6363OW8Rh.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\XClient.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	131 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	131 Virtualization/Sandbox Evasion	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
V6363OW8Rh.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT
V6363OW8Rh.exe	100%	Avira	HEUR/AGEN.1305769
V6363OW8Rh.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\XClient.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\XClient.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\XClient.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.XWormRAT

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
price-slow.gl.at.ply.gg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
price-slow.gl.at.ply.gg	147.185.221.18	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
price-slow.gl.at.ply.gg	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	V6363OW8Rh.exe, 00000000.00000002.2981859011.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.18	price-slow.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465434
Start date and time:	2024-07-01 16:32:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	V6363OW8Rh.exe renamed because original name is a hash value
Original Sample Name:	f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/6@1/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 98% Number of executed functions: 38 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target XClient.exe, PID 2056 because it is empty
Execution Graph export aborted for target XClient.exe, PID 2812 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: V6363OW8Rh.exe

Simulations

Behavior and APIs

Time	Type	Description
10:32:56	API Interceptor	1573131x Sleep call for process: V6363OW8Rh.exe modified
16:32:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XClient C:\Users\user\AppData\Roaming\XClient.exe
16:33:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XClient C:\Users\user\AppData\Roaming\XClient.exe
16:33:14	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.18	a.exe	Get hash	malicious	Unknown	Browse
	wzcstatus.exe	Get hash	malicious	Unknown	Browse
	wzcsapi.exe	Get hash	malicious	XWorm	Browse
	bKwh3xPyu9.exe	Get hash	malicious	Quasar	Browse
	pSZnQqzOqX.exe	Get hash	malicious	XWorm	Browse
	LHA9oUEAwZ.exe	Get hash	malicious	XWorm	Browse
	QPwcImk1p4.exe	Get hash	malicious	Quasar	Browse
	#U7a3d.#U67e5.#U4f01.#U4e1a.#U540d.#U5355.#U624b#U518c.exe	Get hash	malicious	Unknown	Browse
	bUjO.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse
	HyAPVwJTZG.exe	Get hash	malicious	Orcus	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	Ph58Rkdxor.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	4kvADqDmZ4.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	147.185.221.20
	BviOG97ArX.elf	Get hash	malicious	Mirai, Moobot	Browse	147.176.119.108
	a.exe	Get hash	malicious	Unknown	Browse	147.185.221.18
	hatabat.exe	Get hash	malicious	Blank Grabber, DCRat, XWorm	Browse	147.185.221.17
	Build.exe	Get hash	malicious	RedLine	Browse	147.185.221.16
	Discord Tools.exe	Get hash	malicious	XWorm	Browse	147.185.221.20
	Wave.exe	Get hash	malicious	XWorm	Browse	147.185.221.19
	Updater.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.19
	Image logger beta.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.20

Process:	C:\Users\user\Desktop\V6363OW8Rh.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	5.3718223239563105
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6o6+vxp3/elStHTHhAHKKkhHNp51qHGIs0HKD:iqbYqGSI6o9Zp/elStzHeqKkhtp5wmjB
MD5:	31EF241F1F20FCB19A5F31BA847A045B
SHA1:	EF969D35B4517591F0761196C80EC3596497D890
SHA-256:	06C7CEBB25F733FC6E607865E9268C51ED87F001379A5C35A8FB1BEF13756D31
SHA-512:	8643C52CA4C18D62EF54591EB342E60C11B40BFA0680B3ECD63BF4B9A67486CCEA4B5FA3EE0ACEAAB835D2501894B1AE8A0077FC19B8C51D1192D671A83E30F4
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\XClient.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat

Download File

Process:	C:\Users\user\Desktop\V6363OW8Rh.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	157
Entropy (8bit):	5.1103980176192945
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtv3DN2+Hvhs9zTWT8VwDwU1hGDN+E2J5xAInTRIOFAVZPy:hWKqTtLN2KO9/WT8SDNeN723fTv2Vk
MD5:	C035E85AF7ED335B5BA8A9428D831358
SHA1:	9EB420972065C03853E62C6D060FD8A96D4A130F
SHA-256:	32829384A4B18729D0638708F3814F72E8A3BB6E63A15599C237B57C95FC408E
SHA-512:	420BC8AB102417BFC60C0A5D31767938AF684D636353FBC0F825F789496604966A549278BFB9B9A66168CF79DBD90080D3FF0E821C7EBBF7620D0D057F6E8B4B
Malicious:	false
Reputation:	low
Preview:	@echo off..timeout 3 > NUL..CD C:\Users\user\Desktop..DEL "V6363OW8Rh.exe" /f /q..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpAD99.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Download File

Process:	C:\Users\user\Desktop\V6363OW8Rh.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Jul 1 13:32:56 2024, mtime=Mon Jul 1 13:32:56 2024, atime=Mon Jul 1 13:32:56 2024, length=74240, window=hide
Category:	dropped
Size (bytes):	767
Entropy (8bit):	5.061334428770196
Encrypted:	false
SSDEEP:	12:8jjK245qpnu8ChzlXIsY//v4LqLgfjARG+HkQhl/mV:8cIDWlXUY0grARGFQhBm
MD5:	65DD5F862245E13F4F13BA240648F89D
SHA1:	F0FC19FEFB693A23C118DC1423EA28F6CCED221A
SHA-256:	54CF6C7784B3DF26CBEF7D5E21DB189407B859F5102F3D0850969D0D8F791F67
SHA-512:	8DB53500EF2414182A07F3C2EC8115644EC480A77808E2DD9DC31415D3542CA3FE87E300A69D921245D7EFF92893A5AF97EA8823F2185ADCB29EB34120FB7939
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....G.......G.......G......"......................v.:..DG..Yr?.D..U..k0.&...&.......$..S.............S.........t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.X.t...........................^.A.p.p.D.a.t.a...B.V.1......X.t..Roaming.@......EW<2.X.t..../.......................-.R.o.a.m.i.n.g.....b.2.."...X.t .XClient.exe.H.......X.t.X.t............................(.X.C.l.i.e.n.t...e.x.e.......\...............-.......[...........*SS!.....C:\Users\user\AppData\Roaming\XClient.exe........\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e.`.......X.......878411...........hT..CrF.f4... .s...Jc...-...-$..hT..CrF.f4... .s...Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\XClient.exe

Download File

Process:	C:\Users\user\Desktop\V6363OW8Rh.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74240
Entropy (8bit):	5.966367505764052
Encrypted:	false
SSDEEP:	1536:VxEuAytfJGZfzoGwPZ3kbyZ0nbo2CESOOXEnqjQc8:VDCzLwPZ3kbyUZSOOXDt8
MD5:	1B5B62E15509EFCE8BB5379B28A5210B
SHA1:	E647FF934FC92B65344CB115B35C32E3792D36CC
SHA-256:	F7A2183A529D01B8DDC02990103866057D1084444968E93862BF1F83D2467947
SHA-512:	1D2F5872BEA5C9742BE431B7C6FDB78BB5B34E37DADF75AE764296681F568A465BB321588B445FF7657DB40D1C883512814B6A1EAD342624E0B34FAAA2A16C60
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....yf............................n6... ...@....@.. ....................................@................................. 6..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................P6......H........a..P.......&.....................................................(.....r...p. ..?...(.....rS..p. ....s.........s.........s.........s..........r...p. .....r}..p. .(T..r...p. .G%..r...p. ....r<..p. /QY...((....r...p. .....r@..p. .g..&(....&+..+5sL... .... .'..oM...(...~....-.(A...(3...~....oN...&.-..r...p. .....rR..p. .y4..r...p. .O...r\|..p. S.................j..................sO.............."(C...+.:.t....(>...+..r...p. y."..r

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.966367505764052
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	V6363OW8Rh.exe
File size:	74'240 bytes
MD5:	1b5b62e15509efce8bb5379b28a5210b
SHA1:	e647ff934fc92b65344cb115b35c32e3792d36cc
SHA256:	f7a2183a529d01b8ddc02990103866057d1084444968e93862bf1f83d2467947
SHA512:	1d2f5872bea5c9742be431b7c6fdb78bb5b34e37dadf75ae764296681f568a465bb321588b445ff7657db40d1c883512814b6a1ead342624e0b34faaa2a16c60
SSDEEP:	1536:VxEuAytfJGZfzoGwPZ3kbyZ0nbo2CESOOXEnqjQc8:VDCzLwPZ3kbyUZSOOXDt8
TLSH:	AD737E183BEA4125F1BFAFF65DE03152DA36F7532503E25F14C9028B5722E85CD41ABA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....yf............................n6... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41366e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66798FB9 [Mon Jun 24 15:24:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13620	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x4ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x11674	0x11800	ea555678c364ac6c71c2677537762204	False	0.5968470982142857	data	6.039352148615764	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x4ce	0x600	f9052177c59fad11b6e11866b69a673f	False	0.375	data	3.726864092899557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0xc	0x200	db111ab688e6451cab5def3ba2fd3a78	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x140a0	0x244	data			0.4724137931034483
RT_MANIFEST	0x142e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-16:33:46.361784	TCP	2853369	ETPRO TROJAN Win32/XWorm V2 CnC Command - PING Outbound	49708	28067	192.168.2.6	147.185.221.18
07/01/24-16:34:22.518215	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49708	28067	192.168.2.6	147.185.221.18
07/01/24-16:34:08.236813	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49709	28067	192.168.2.6	147.185.221.18
07/01/24-16:34:04.550316	TCP	2853370	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49700	28067	192.168.2.6	147.185.221.18
07/01/24-16:33:14.582494	TCP	2853371	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49700	28067	192.168.2.6	147.185.221.18
07/01/24-16:34:10.018964	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49710	28067	192.168.2.6	147.185.221.18
07/01/24-16:33:45.579382	TCP	2853376	ETPRO TROJAN Win32/XWorm V3 CnC Command - sendPlugin Outbound	49700	28067	192.168.2.6	147.185.221.18
07/01/24-16:33:38.196360	TCP	2853372	ETPRO TROJAN Win32/XWorm CnC Command - Ping Inbound	28067	49700	147.185.221.18	192.168.2.6
07/01/24-16:34:19.065107	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49713	28067	192.168.2.6	147.185.221.18
07/01/24-16:34:12.659041	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49712	28067	192.168.2.6	147.185.221.18
07/01/24-16:34:21.780689	TCP	2852923	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	49700	28067	192.168.2.6	147.185.221.18
07/01/24-16:34:22.470923	TCP	2852870	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes	28067	49700	147.185.221.18	192.168.2.6
07/01/24-16:33:45.837234	TCP	2853377	ETPRO TROJAN Win32/XWorm V3 CnC Command - savePlugin Inbound	28067	49700	147.185.221.18	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 16:33:01.327536106 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:01.333019018 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:01.333081961 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:01.490904093 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:01.495769024 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:14.582494020 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:14.587399960 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:23.108350039 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:23.158464909 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:24.068151951 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:24.073023081 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:27.584544897 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:27.589534998 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:27.830003977 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:27.838783979 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:27.845150948 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:38.196360111 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:38.236582994 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:40.627455950 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:40.632474899 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:40.872330904 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:40.874181986 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:40.879082918 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.576946020 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.579381943 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:45.584150076 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837234020 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837259054 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837275028 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837286949 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837341070 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:45.837372065 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837383986 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:45.837384939 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837435961 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:45.837502956 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837513924 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.837549925 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:45.837775946 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.838062048 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.838073969 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.838083982 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:45.838110924 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:45.838135958 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:45.986874104 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.032088995 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.033449888 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.036945105 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.037024021 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.050124884 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.261481047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.261548996 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.266372919 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.361783981 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.367590904 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.471137047 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.475971937 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.580760956 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.586124897 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.591660976 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.601995945 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.606956005 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.607120037 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.607824087 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.612570047 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.642858028 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.689894915 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.695801020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.705566883 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.710310936 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.801071882 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.806699991 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.814974070 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.820394993 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.908735991 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.914443016 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:46.924313068 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:46.929406881 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.018152952 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.024698019 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.033677101 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.039429903 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.127486944 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.132399082 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.146389961 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.151262999 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.239016056 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.245754004 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.256645918 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.261584997 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.362337112 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.366184950 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.367269993 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.371243954 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.471148968 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.471149921 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.476274014 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.476300001 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.580595016 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.580596924 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.585485935 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.585510969 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.689940929 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.689941883 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.694911003 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.694931030 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.799357891 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.804240942 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.810754061 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.816720963 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.924226046 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.924226999 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:47.931005001 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:47.931282997 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.033674955 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.033679008 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.038798094 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.038811922 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.143009901 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.143687010 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.149555922 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.150041103 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.252476931 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.253000975 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.257448912 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.257913113 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.290153027 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.300654888 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.305912018 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.305986881 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.306792974 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.312828064 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.330467939 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.361808062 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.361809969 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.366673946 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.366815090 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.408809900 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.413635015 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.471131086 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.471213102 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.475960970 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.476058960 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.520859957 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.525651932 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.580595970 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.581397057 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.585758924 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.586251020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.627491951 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.632528067 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.689841986 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.690566063 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.694777966 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.695342064 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.737005949 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.742021084 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.799384117 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.799967051 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.804579020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.804935932 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.846292973 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.851136923 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.908978939 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.909625053 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.913805962 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.914555073 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:48.955792904 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:48.960656881 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.018148899 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.018738985 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.023133039 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.023688078 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.065159082 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.070446968 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.127454996 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.128195047 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.132394075 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.133037090 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.174541950 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.179483891 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.247203112 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.247927904 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.252819061 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.253355026 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.283763885 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.288737059 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.361727953 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.362335920 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.366579056 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.367166042 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.393503904 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.398325920 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.471096992 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.471100092 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.476397991 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.476644039 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.502468109 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.507239103 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.580634117 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.581209898 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.586738110 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.587275982 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.611952066 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.616683006 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.689848900 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.690459967 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.694673061 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.695276022 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.721055984 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.725853920 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.800282001 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.800906897 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.806155920 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.806983948 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.830586910 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.837912083 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.908714056 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.909368992 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.913563967 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.914128065 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:49.940633059 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:49.945429087 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.018157005 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.019020081 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.025635004 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.027909040 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.049303055 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.054056883 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.127403975 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.128082991 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.132225990 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.132846117 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.158649921 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.163414955 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.237236977 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.237857103 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.242022991 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.242651939 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.282243013 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.288642883 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.346256018 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.346306086 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.351376057 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.351517916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.393374920 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.398268938 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.455667019 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.455691099 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.460664988 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.460680962 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.502497911 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.507356882 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.564857006 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.565422058 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.569730997 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.586596966 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.612359047 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.617326021 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.674314976 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.676386118 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.679348946 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.681293964 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.721242905 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.726193905 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.783725977 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.783771992 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.788961887 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.788990974 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.830804110 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.837920904 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.893027067 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.893059015 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.899197102 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.899213076 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.940246105 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:50.945110083 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:50.996401072 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.002388954 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.003674030 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.007273912 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.008449078 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.010474920 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.018385887 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.018970013 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.019808054 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.024570942 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.049159050 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.049442053 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.055512905 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.111958981 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.112600088 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.113066912 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.116857052 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.117415905 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.117897034 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.158740044 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.163549900 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.221308947 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.221323013 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.221803904 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.226154089 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.226530075 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.226588964 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.268429041 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.277700901 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.330775976 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.331557989 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.332653999 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.335603952 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.336361885 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.337368965 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.377429962 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.382364988 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.444154978 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.449093103 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.460717916 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.461523056 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.465698957 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.466440916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.486978054 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.491894960 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.564924955 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.564974070 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.565769911 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.570797920 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.584269047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.584362030 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.596120119 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.608041048 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.674453020 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.674495935 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.675105095 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.679282904 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.679305077 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.679846048 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.705581903 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.710449934 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.783732891 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.784303904 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.784358978 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.788646936 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.789041996 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.789141893 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.814941883 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.819766045 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.893191099 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.893192053 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.893871069 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.898015022 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.898159027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.898685932 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:51.924362898 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:51.929244995 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.002876997 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.003810883 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.004215002 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.009156942 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.010107040 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.010524988 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.033854961 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.038650036 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.111958027 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.112095118 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.112962961 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.117631912 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.117712021 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.118087053 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.143172026 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.149871111 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.221138954 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.221951962 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.222639084 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.225951910 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.226850986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.227371931 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.252403021 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.257222891 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.354001045 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.354645014 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.355117083 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.359057903 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.359425068 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.360301971 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.362127066 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.366909981 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.455883980 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.456634998 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.460707903 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.461420059 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.471374035 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.476140976 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.495342016 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.500140905 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.565244913 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.565924883 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.584427118 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.584533930 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.596141100 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.596674919 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.600899935 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.601497889 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.678539991 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.683679104 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.685409069 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.690226078 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.706043959 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.706043959 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.710796118 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.710939884 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.799277067 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.799278975 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.804150105 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.804204941 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.814877033 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.815382957 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.819673061 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.820118904 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.908631086 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.908637047 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.913558960 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.913572073 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.924243927 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.924245119 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:52.929145098 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:52.929194927 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.018361092 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.019028902 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.024837971 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.025662899 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.033740997 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.034405947 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.040549994 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.041055918 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.127429008 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.128062963 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.132272005 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.132875919 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.143014908 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.143520117 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.148761034 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.149262905 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.236891985 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.236932993 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.241722107 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.241874933 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.252422094 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.253042936 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.257360935 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.257936001 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.346987009 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.347614050 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.351821899 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.352384090 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.370574951 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.371216059 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.375427008 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.375916004 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.455579042 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.455590010 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.460511923 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.460568905 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.486834049 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.487332106 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.491652012 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.492237091 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.564964056 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.564965010 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.582396030 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.582454920 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.596115112 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.596626997 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.601332903 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.602828026 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.674493074 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.675173998 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.675662994 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.679239988 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.679898977 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.680377007 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.705588102 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.706280947 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.710447073 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.711091042 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.783638000 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.784195900 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.788471937 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.788979053 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.815001011 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.815606117 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.819827080 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.820489883 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.893151045 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.894325972 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.898199081 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.899085999 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.918684006 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.920530081 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.924278021 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.924803019 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:53.925329924 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.929405928 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:53.930403948 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.002492905 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.002499104 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.007589102 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.007627010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.033623934 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.034245968 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.038867950 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.039036989 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.111855984 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.111857891 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.116832972 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.116928101 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.143098116 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.143102884 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.148762941 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.149183035 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.221085072 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.221086025 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.226016045 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.226135969 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.252365112 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.252476931 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.257824898 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.257972002 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.330749989 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.331341028 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.335577011 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.336235046 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.363611937 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.364758968 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.368506908 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.369596004 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.440109968 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.440685034 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.445075989 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.445666075 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.471255064 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.471929073 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.476147890 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.476707935 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.549362898 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.549938917 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.554883003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.555123091 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.580703020 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.580703020 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.596050024 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.596184969 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.658708096 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.658708096 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.665854931 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.665868044 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.690053940 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.690099955 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.694947958 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.695179939 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.768176079 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.768177032 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.773066998 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.773159027 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.799489975 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.799493074 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.804440022 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.804526091 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.877435923 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.877469063 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.884303093 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.884579897 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.908911943 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.909574032 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.913887978 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.916290998 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.986941099 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.987526894 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:54.994046926 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:54.994128942 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.018177986 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.018802881 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.023068905 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.023598909 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.096266031 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.096268892 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.101237059 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.101264000 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.127512932 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.128139973 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.132499933 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.132905006 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.205595016 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.206296921 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.210489035 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.211098909 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.236867905 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.237487078 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.241800070 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.242250919 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.315026045 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.315629005 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.319988012 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.320573092 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.346200943 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.346201897 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.351176023 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.351200104 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.424529076 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.425164938 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.429526091 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.430022001 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.455809116 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.455809116 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.460824013 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.460975885 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.533886909 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.534929037 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.538669109 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.539762020 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.564946890 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.566073895 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.582350969 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.582881927 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.643044949 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.643668890 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.647957087 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.648417950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.674351931 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.674808025 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.679250002 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.679749012 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.752504110 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.753134966 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.757416964 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.759022951 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.783633947 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.784301043 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.788594007 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.789078951 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.861829042 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.861830950 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.866682053 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.866799116 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.892996073 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.893018961 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.897835970 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.898066044 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.971193075 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.971194983 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:55.976383924 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:55.976522923 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.002480030 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.002527952 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.082902908 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.083805084 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.222038984 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.232824087 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.232841015 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.232851028 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.232861042 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.232881069 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.232903957 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.232908010 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.232933044 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.232954979 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.238276958 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.238286972 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.238296032 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.238306999 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.299549103 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.299551010 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.305471897 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.305488110 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.330534935 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.331139088 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.338620901 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.338721037 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.408973932 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.409645081 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.414838076 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.414851904 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.439979076 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.440579891 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.446557999 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.448251963 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.518157959 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.518157005 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.526295900 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.527163982 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.549309969 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.549310923 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.554267883 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.554505110 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.627505064 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.628159046 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.632363081 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.633069992 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.658746958 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.659358978 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.663587093 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.664218903 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.736987114 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.736990929 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.741813898 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.741827011 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.768199921 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.768758059 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.774121046 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.774588108 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.846174955 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.846834898 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.851052046 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.851687908 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.877357960 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.877866983 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.882620096 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.884186029 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.955566883 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.955566883 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.960319996 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.960452080 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.986795902 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.987301111 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:56.991601944 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:56.992120981 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.064984083 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.065002918 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.077553034 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.077786922 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.096270084 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.096945047 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.101965904 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.102402925 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.174402952 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.175151110 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.179265976 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.179893017 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.205590963 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.206239939 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.210494041 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.283782005 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.283782005 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.315700054 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.441231012 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.442452908 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.442465067 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.442475080 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.442485094 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.442512035 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.442543030 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.442544937 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.445580006 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.447356939 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.447366953 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.447375059 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.450447083 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.450767994 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.455562115 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.455631971 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.456407070 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.461476088 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.486582041 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.502774954 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.503618002 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.508466005 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.508480072 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.533839941 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.534485102 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.538655996 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.539216042 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.565035105 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.572278023 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.612245083 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.617157936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.627509117 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.632317066 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.643038988 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.643625975 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.649175882 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.650144100 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.674278975 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.679110050 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.721287966 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.730463028 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.737195969 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.746041059 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.752667904 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.754489899 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.761710882 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.761867046 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.783935070 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.788793087 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.830801010 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.840173006 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.846298933 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.854046106 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.861818075 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.861819029 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.869801998 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.869816065 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.893114090 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.898099899 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.946929932 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.951874018 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.957057953 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.961836100 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.972096920 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.972693920 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:57.977103949 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:57.977641106 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.003500938 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.008677006 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.049385071 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.054775953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.064990997 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.070391893 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.080801964 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.081523895 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.086252928 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.086973906 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.112088919 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.117676020 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.158802032 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.164632082 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.174777031 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.180634022 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.190013885 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.190015078 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.195827961 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.195993900 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.221174955 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.227149010 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.268141031 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.274229050 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.283576965 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.289719105 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.301697016 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.302270889 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.307758093 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.308521986 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.331811905 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.337174892 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.377629995 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.387758017 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.393817902 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.400687933 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.408603907 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.409105062 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.414947033 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.415528059 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.440224886 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.446681023 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.487442017 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.493896008 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.502423048 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.507549047 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.518207073 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.518815994 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.524034977 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.524590969 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.549469948 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.554205894 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.596189022 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.601030111 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.611716032 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.617906094 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.627336025 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.627831936 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.635349989 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.635385990 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.658545017 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.667253971 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.705612898 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.710352898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.721231937 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.729310036 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.737143040 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.737175941 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.742656946 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.742717028 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.768265963 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.773896933 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.815089941 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.819874048 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.830735922 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.836570978 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.846075058 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.846544027 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.850868940 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.852123976 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.886570930 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.891567945 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.924396038 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.929734945 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.939917088 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.944782019 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.955616951 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.956275940 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:58.962415934 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:58.962837934 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.002521992 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.007420063 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.033626080 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.038358927 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.049427986 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.054344893 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.064857960 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.065370083 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.069638014 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.070128918 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.111906052 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.116733074 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.143064022 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.147856951 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.158588886 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.164182901 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.174520016 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.175074100 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.179322004 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.179824114 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.221208096 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.226068020 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.252469063 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.258049011 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.268243074 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.273121119 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.283730030 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.283745050 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.288575888 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.288676023 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.330615044 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.335500956 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.361927032 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.366936922 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.377371073 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.382227898 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.393049002 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.393722057 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.397914886 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.398582935 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.440140009 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.447943926 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.471306086 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.481822968 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.486902952 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.493294001 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.502438068 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.502985954 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.507297993 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.507781029 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.549407005 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.554277897 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.580770016 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.586680889 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.596148014 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.600975037 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.611742020 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.612301111 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.616646051 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.617130041 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.658634901 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.663398027 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.689980984 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.695594072 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.705583096 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.710372925 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.721127033 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.721699953 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.725997925 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.726501942 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.768351078 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.773185015 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.799410105 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.805613041 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.814884901 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.822293997 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.830488920 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.831105947 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.835422993 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.836510897 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.877331972 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.882246971 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.909224987 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.914088964 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.924303055 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.929152966 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.939935923 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.940036058 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.944866896 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.945238113 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:33:59.986766100 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:33:59.992867947 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.018217087 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.027137995 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.033832073 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.041614056 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.049448013 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.050012112 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.055479050 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.055982113 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.096281052 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.104679108 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.127471924 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.132488966 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.143039942 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.147938013 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.158693075 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.158720016 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.163475990 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.163549900 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.205586910 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.210534096 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.237015009 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.242413998 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.252511978 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.257280111 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.268114090 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.268728971 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.273547888 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.273874044 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.314981937 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.319822073 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.346399069 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.351167917 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.361799955 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.367031097 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.377455950 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.377480030 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.382328033 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.382352114 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.424457073 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.431024075 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.455672979 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.460534096 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.471311092 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.476166964 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.486880064 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.487409115 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.491739035 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.492217064 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.533737898 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.538587093 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.570477962 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.580790043 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.584443092 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.586401939 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.596259117 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.596815109 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.601048946 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.602299929 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.643207073 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.648221970 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.674304008 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.679183960 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.705466032 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.706187010 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.706742048 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.710290909 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.711005926 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.711898088 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.752373934 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.761306047 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.783577919 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.788794041 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.814927101 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.814946890 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.815968990 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.820708990 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.821248055 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.821573019 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.861809015 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.866759062 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.893106937 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.898072958 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.924660921 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.925363064 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.926443100 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.930305958 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.930461884 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.931256056 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:00.971085072 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:00.975924969 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.002418041 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.007268906 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.033591032 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.034164906 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.038552999 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.038975000 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.049209118 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.054145098 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.080518961 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.085525990 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.111813068 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.116692066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.143096924 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.143942118 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.148724079 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.148791075 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.158552885 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.163412094 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.189862967 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.195075035 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.221098900 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.225922108 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.252429008 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.253062963 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.257324934 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.258594990 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.268304110 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.273904085 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.299534082 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.304884911 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.330598116 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.336110115 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.361869097 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.362668037 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.368355989 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.369297981 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.377295971 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.382067919 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.408617973 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.415375948 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.439934969 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.444866896 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.471165895 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.471208096 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.476064920 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.476133108 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.486937046 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.491833925 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.518172026 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.523077011 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.549393892 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.554478884 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.581012964 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.581634045 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.588156939 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.588221073 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.596050978 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.600999117 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.627340078 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.632287979 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.658685923 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.663723946 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.689824104 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.690382957 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.694711924 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.695174932 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.705615044 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.710530043 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.737839937 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.742814064 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.768831968 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.773829937 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.799295902 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.800332069 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.804135084 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.805165052 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.814956903 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.820174932 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.852883101 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.860580921 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.877502918 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.882353067 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.911506891 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.916383982 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.926064014 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.930918932 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.933543921 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.938646078 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:01.985260010 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:01.990163088 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.005732059 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.010535955 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.038753033 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.043319941 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.043678045 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.048080921 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.054555893 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.059817076 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.096210957 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.101070881 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.127799988 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.132631063 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.158715963 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.159518003 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.159540892 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.163702011 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.164381027 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.164514065 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.206049919 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.210891962 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.237229109 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.242147923 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.268392086 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.269094944 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.269118071 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.274209976 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.274884939 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.274981022 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.315413952 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.320353985 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.346973896 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.352593899 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.378315926 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.379395008 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.380151987 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.384341002 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.385158062 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.386243105 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.424937010 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.429907084 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.455734015 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.460576057 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.486787081 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.487412930 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.487473965 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.491580009 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.492248058 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.492342949 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.533711910 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.538551092 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.564840078 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.582214117 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.596064091 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.596141100 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.597224951 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.600903988 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.601254940 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.601989985 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.643150091 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.648072004 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.674705982 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.679598093 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.705609083 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.705670118 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.706590891 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.710449934 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.710644007 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.711294889 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.752379894 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.757466078 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.783598900 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.788501024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.814810038 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.814810991 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.815979004 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.821681976 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.824707985 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.824747086 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.862025023 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.867050886 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.893697977 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.898734093 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.924254894 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.924887896 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.924909115 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.929115057 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.929904938 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.929986954 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:02.971537113 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:02.976536036 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.003297091 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.008796930 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.063152075 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.063991070 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.065052032 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.068018913 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.069319963 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.069837093 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.082211018 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.088068962 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.113464117 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.118731022 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.176250935 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.177288055 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.177849054 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.186559916 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.187482119 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.187797070 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.191732883 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.201901913 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.222961903 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.247862101 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.283740044 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.284504890 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.284521103 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.291644096 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.291660070 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.291768074 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.301366091 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.308403969 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.332770109 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.339992046 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.397232056 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.398413897 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.398948908 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.404623032 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.405652046 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.406176090 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.408802986 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.415993929 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.441651106 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.449672937 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.505153894 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.505829096 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.506532907 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.513526917 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.514121056 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.514266014 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.521528006 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.529243946 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.549545050 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.561692953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.612185001 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.612879038 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.613565922 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.620076895 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.620510101 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.621448040 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.627559900 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.635224104 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.658622026 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.667205095 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.721219063 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.721252918 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.722182035 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.729084969 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.729106903 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.730640888 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.736780882 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.744478941 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.752443075 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.761217117 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.768115044 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.777225971 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.830885887 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.831697941 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.832700014 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.841368914 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.843857050 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.844122887 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.846143007 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.856878996 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.877403021 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.888345003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.940027952 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.940747023 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.941514969 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.950284004 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.951894045 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.952188969 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.955513954 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.965595961 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:03.986908913 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:03.996104956 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.049760103 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.051501036 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.059590101 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.061846972 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.062515020 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.065049887 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.070992947 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.075098038 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.098031044 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.107789993 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.158730984 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.161864042 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.164635897 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.167820930 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.172826052 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.174441099 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.175755978 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.182565928 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.185586929 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.190058947 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.198972940 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.206074953 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.215883970 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.271389961 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.279726028 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.286185026 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.296082973 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.301428080 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.309211969 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.309256077 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.318135023 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.319109917 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.328028917 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.430275917 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.432195902 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.433410883 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.434123039 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.434660912 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.440582037 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.442044973 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.442694902 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.443207979 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.443685055 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.533912897 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.534643888 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.539727926 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.540366888 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.550064087 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.550316095 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.550319910 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.552503109 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.556663990 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.556679010 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.556901932 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.558300018 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.643261909 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.648231983 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.648736000 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.653275013 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.659070969 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.659077883 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.659210920 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.663950920 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.664024115 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.664139986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.752366066 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.756191969 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.757319927 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.761132002 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.772299051 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.773309946 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.773417950 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.777333021 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.778167963 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.778223038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.796961069 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.801213980 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.806519985 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.861808062 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.861897945 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.866866112 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.867043018 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.877943993 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.877944946 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.877945900 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.883066893 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.883168936 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.883184910 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.971925020 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.971936941 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.976974964 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.977104902 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.986776114 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.986778975 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.988198996 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:04.991734028 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.991962910 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:04.993143082 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.096973896 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.098151922 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.098184109 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.098292112 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.098352909 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.101994038 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.103061914 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.103142977 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.103158951 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.103234053 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.205492973 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.206449032 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.206489086 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.207159996 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.208230019 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.210401058 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.212394953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.212534904 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.213078976 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.213174105 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.314908981 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.315918922 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.316016912 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.316174030 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.316222906 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.320044041 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.320806980 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.320898056 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.320976019 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.321170092 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.424873114 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.427253962 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.429326057 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.429872036 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.432249069 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.434149027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.439563036 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.440737009 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.445566893 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.445730925 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.533615112 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.534503937 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.538573027 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.539319992 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.549384117 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.549983025 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.550529003 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.554404974 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.554919004 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.555393934 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.643066883 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.643089056 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.652597904 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.652776003 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.658596039 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.659342051 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.659353971 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.663481951 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.664274931 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.664309025 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.754362106 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.755400896 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.759296894 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.760384083 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.772032022 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.776969910 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.785870075 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.786824942 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.792263985 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.792612076 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.862198114 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.862984896 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.867331028 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.867907047 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.877597094 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.882746935 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.894638062 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.895518064 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.900036097 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.900495052 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.971301079 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.972069025 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.976212025 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.977113962 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:05.986891031 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:05.992984056 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.003045082 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.003060102 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.007942915 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.007999897 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.081453085 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.081460953 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.086570024 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.086601019 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.098076105 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.103213072 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.112699986 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.112729073 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.119312048 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.119370937 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.190764904 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.190768003 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.195735931 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.195781946 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.206095934 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.210920095 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.222287893 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.223112106 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.227407932 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.227909088 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.300421000 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.302544117 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.306750059 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.309006929 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.318167925 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.323697090 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.331696987 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.331697941 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.337763071 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.337893009 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.410927057 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.412430048 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.415936947 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.417210102 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.426173925 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.431113005 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.440793037 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.440830946 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.445720911 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.445849895 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.519149065 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.519752979 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.524102926 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.524523973 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.537137985 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.541939020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.550035000 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.552512884 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.554897070 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.557322025 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.628473043 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.628503084 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.633388042 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.633460999 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.644252062 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.649157047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.684199095 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.685143948 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.689496994 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.690068007 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.737258911 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.742280006 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.748402119 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.759483099 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.762511969 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.764348030 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.829580069 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.831271887 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.834635973 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.836211920 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.848459959 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.853785992 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.861990929 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.866843939 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.877310991 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.882199049 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.940510988 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.940702915 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.945350885 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.945559978 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.956515074 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.961723089 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.971237898 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.976043940 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:06.986974955 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:06.992542982 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.049343109 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.050198078 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.054271936 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.055108070 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.064961910 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.071074009 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.080655098 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.085587025 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.096077919 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.101121902 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.158701897 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.158703089 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.163613081 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.163795948 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.174294949 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.179302931 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.189867020 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.194809914 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.205508947 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.210793972 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.268063068 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.268099070 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.273097038 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.273288012 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.283593893 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.288714886 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.299803972 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.304838896 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.314923048 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.377393961 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.378182888 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.393100977 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.408679962 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.595989943 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.602339983 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.602354050 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.602364063 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.602392912 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.602416039 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.602428913 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.602461100 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.602473974 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.602483034 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.602505922 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.602557898 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.607182980 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.607204914 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.607304096 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.607317924 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.607425928 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.611906052 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.616739988 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.627465963 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.632394075 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.643317938 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.648812056 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.695512056 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.705573082 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.705630064 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.710434914 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.710450888 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.721153975 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.725980043 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.736601114 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.736881018 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.741619110 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.752490997 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.757299900 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.814929962 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.815896034 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.819888115 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.820765018 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.831080914 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.835964918 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.846335888 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.851093054 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.861969948 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.866736889 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.924411058 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.924417019 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.929430008 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.929721117 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.939934015 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.945065975 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.955813885 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:07.962268114 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:07.994452953 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.001797915 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.033668995 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.033684969 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.041405916 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.041423082 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.124341965 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.124347925 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.126070976 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.129501104 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.129529953 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.130938053 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.188395023 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.236777067 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.236777067 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.236813068 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.241888046 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.241904020 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.271943092 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.272011042 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.296216965 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.296236992 CEST	49709	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.302766085 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.302786112 CEST	28067	49709	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.344113111 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.350857973 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.387901068 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.394555092 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.408621073 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.413470984 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.458115101 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.463032007 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.504935980 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.505784035 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.510067940 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.510536909 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.567275047 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.567939997 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.572029114 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.572698116 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.612062931 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.618032932 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.674365044 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.674379110 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.680407047 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.680419922 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.704843044 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.704859018 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.712963104 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713088989 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713099003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713109016 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713119984 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713217020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713226080 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713236094 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713246107 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713259935 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713268042 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.713702917 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.768064976 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.774846077 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.814903021 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.814965010 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.818063974 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.823743105 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.823760033 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.826617956 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.877655029 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.882699013 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.924336910 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.926009893 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.926014900 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.929455042 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.930845976 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.930857897 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:08.986880064 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:08.991945028 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.021466970 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.033704996 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.034918070 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.035038948 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.038532972 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.039683104 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.039803028 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.064743996 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.073487997 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.078691959 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.078763008 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.078773975 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.096131086 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.142400026 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.143202066 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.143243074 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.144241095 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.148010015 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.148020983 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.149106979 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.206072092 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.212209940 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.252532959 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.252562046 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.253568888 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.257297993 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.257395983 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.258430004 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.315066099 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.361864090 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.361865997 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.362807035 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.499275923 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.499327898 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.499984026 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.499994993 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.500005960 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.500016928 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.500046968 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.500071049 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.500073910 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.504152060 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.505644083 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.505654097 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.505662918 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.540638924 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.545523882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.561460018 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.566462994 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566477060 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566488981 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566493034 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566497087 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566528082 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566668034 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566765070 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566776991 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566786051 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.566793919 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.580852985 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.581784010 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.582628965 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.588609934 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.589055061 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.589541912 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.647715092 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.652689934 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.693810940 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.694437027 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.694880009 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.698721886 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.699248075 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.699697018 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.752824068 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.757839918 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.799767971 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.800570965 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.800606012 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.804994106 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.805476904 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.805489063 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.825853109 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.864855051 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.869839907 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.908724070 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.909324884 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.909775019 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.913510084 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.914110899 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.914587975 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.953125000 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.962100983 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.962179899 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.962419987 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.962430954 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.962474108 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.962532997 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963315964 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963331938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963351965 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963361979 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963371038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963381052 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963390112 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.963745117 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.967551947 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.967636108 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970133066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970185041 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970247984 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970257998 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970278025 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970288038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970407009 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970416069 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970426083 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970436096 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970448017 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970457077 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970520020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970530033 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970541954 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970608950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970619917 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970673084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970683098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970691919 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970700979 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970793009 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970803022 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970812082 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970820904 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970904112 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.970947027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:09.971206903 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:09.977041006 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.018769026 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.018773079 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.018964052 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.025321007 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.025336981 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.025346994 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.050790071 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.050992966 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.052437067 CEST	49710	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.057219982 CEST	28067	49710	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.081816912 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.091078997 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.128166914 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.128176928 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.133651018 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.134006977 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.193046093 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.198066950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.236933947 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.238071918 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.241744041 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.242996931 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.300509930 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.306197882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.346376896 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.347214937 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.351332903 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.352191925 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.381244898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.408695936 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.417067051 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.456100941 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.456499100 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.462235928 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.463083982 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.504398108 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.504497051 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.509408951 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509428978 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509452105 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509463072 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509474039 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509496927 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509506941 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509515047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509527922 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509632111 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509643078 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509663105 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509674072 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509685040 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509695053 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509713888 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509744883 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509797096 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509807110 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509839058 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509849072 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509902954 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509912968 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509922981 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509932995 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509953022 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509962082 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.509972095 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510015965 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510026932 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510035992 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510118961 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510128975 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510137081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510147095 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510157108 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510165930 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510174990 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510204077 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510214090 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510230064 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510241032 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510250092 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510268927 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510277987 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510288000 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510298014 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510308027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510325909 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510335922 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510354996 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510365963 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510374069 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.510384083 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.518100977 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.525471926 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.564902067 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.564907074 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.569823980 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.569842100 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.627444983 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.634561062 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.674380064 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.675074100 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.679217100 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.679824114 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.736876965 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.745040894 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.784269094 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.784399033 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.789165974 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.789197922 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.816174030 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.820902109 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.822565079 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.848397970 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.853526115 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.901412010 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.904145002 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.906316042 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.909055948 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.959635973 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.959733963 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.964914083 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.964934111 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.964950085 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965020895 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965125084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965135098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965255022 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965276003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965287924 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965296984 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965306997 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965326071 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965336084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965343952 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965375900 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965388060 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965408087 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965420008 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965435982 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965445995 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965465069 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965475082 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965496063 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965508938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965517998 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965528965 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965547085 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965559006 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965568066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965599060 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965607882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965620995 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965630054 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965682030 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965692043 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965702057 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965713024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965732098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965740919 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965750933 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965785027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965800047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965821028 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965857983 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965955019 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.965964079 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966025114 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966033936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966043949 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966061115 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966070890 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966089964 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966157913 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966167927 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:10.966291904 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:10.971076965 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.002477884 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.007683992 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.018188000 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.024415970 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.063121080 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.065224886 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.070120096 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.080506086 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.086570978 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.111949921 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.116854906 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.127506971 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.132515907 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.189959049 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.194937944 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.221187115 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.226078987 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.237240076 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.242034912 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.291515112 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.301122904 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.307337999 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.330868959 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.338354111 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.346354961 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.352672100 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.408705950 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.414880037 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.439934015 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.444976091 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.445070982 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.447865009 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452570915 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452584982 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452677965 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452725887 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452795029 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452855110 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452919960 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.452981949 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453012943 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453124046 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453135014 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453147888 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453212023 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453222036 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453234911 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453244925 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453293085 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453356981 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453372002 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453382969 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453402042 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453412056 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453474045 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453562975 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453643084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453722000 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453732967 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453746080 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453758955 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453779936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453821898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453831911 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453869104 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453879118 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.453953981 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455157995 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455183983 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455193996 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455214024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455224037 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455276012 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455286026 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455343962 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455354929 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455415010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455426931 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455554962 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455564976 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455636024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455646038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455667973 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455677986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455688953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.455760002 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.456149101 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.466058969 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.518146038 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.523087025 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.549468994 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.554414988 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.565083027 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.570343018 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.627774000 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.633347034 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.658757925 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.663863897 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.674633026 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.679611921 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.736928940 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.741971016 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.768429995 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.773390055 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.783977985 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.788935900 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.846200943 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.851263046 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.860378981 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.877473116 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.882322073 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.893357992 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.898243904 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:11.908504009 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.969712019 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:11.987883091 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.002827883 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.020452023 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.020531893 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.198796034 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201371908 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201385021 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201395035 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201442957 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.201450109 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.201674938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201857090 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201960087 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201972008 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.201977015 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202008963 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202019930 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202030897 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202040911 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202096939 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202107906 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202156067 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202167988 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202214003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202223063 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202342033 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202352047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202362061 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202373981 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202450037 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202460051 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202483892 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202495098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202513933 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202522993 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202583075 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202593088 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202687025 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202703953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202713966 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202723026 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202795029 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202805042 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202862024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202873945 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202893019 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202902079 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.202989101 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203066111 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203136921 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203146935 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203155994 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203208923 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203232050 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203243017 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203253031 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203291893 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203301907 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203413963 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203423977 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203433990 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203444004 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203455925 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.203600883 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.206326962 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.206362963 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.206578016 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.208498001 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.211370945 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.221179962 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.226022959 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.314910889 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.314918041 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.319845915 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.319891930 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.332155943 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.337080002 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.424345016 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.424350977 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.429256916 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.429373980 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.439857960 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.444724083 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.533639908 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.533641100 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.538638115 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.538655043 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.552206039 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.557374001 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.571484089 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.628498077 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.654124022 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.654176950 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.659003019 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.659040928 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.665688992 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.669966936 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.673485994 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.673486948 CEST	49712	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.678443909 CEST	28067	49712	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.698295116 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.698369980 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.702464104 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703269005 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703280926 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703325987 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703336954 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703375101 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703386068 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703444958 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703455925 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703465939 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703485012 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703495979 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703505993 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703560114 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703571081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703591108 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703600883 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703675032 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703685999 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703706026 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703716040 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703726053 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703744888 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703756094 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703766108 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703775883 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703785896 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703834057 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703845024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703855038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703864098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703875065 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703883886 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703905106 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703916073 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703926086 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703934908 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703957081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703965902 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703975916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.703986883 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704005957 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704020977 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704030991 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704041004 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704051971 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704061985 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704068899 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704072952 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704180956 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704190969 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704200983 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704210043 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704221010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.704231024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.770832062 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.770832062 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.775774956 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.775791883 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.878700972 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.878724098 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:12.883600950 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.883713007 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:12.999677896 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.007869005 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.007874012 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.013144016 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.013422012 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.121498108 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.122658968 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.126410007 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.127510071 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.269557953 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.274101019 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.275208950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.279102087 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.360574007 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.360635996 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.365583897 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365600109 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365605116 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365622044 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365633011 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365643978 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365653992 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365797043 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365808964 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365827084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365837097 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365849018 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365859032 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365871906 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365880013 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365988016 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.365998030 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366005898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366025925 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366035938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366081953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366091967 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366101027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366117954 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366127014 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366166115 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366174936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366187096 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366221905 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366231918 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366311073 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366321087 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366329908 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366339922 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366413116 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366424084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366432905 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366470098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366481066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366489887 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366502047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366570950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366581917 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366590023 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366601944 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366621017 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366631031 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366641045 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366651058 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366660118 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366669893 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366688967 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366698027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366708040 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.366719961 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.367106915 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.379633904 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.380960941 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.385001898 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.385859013 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.486979961 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.487890959 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.491864920 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.492626905 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.596326113 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.597209930 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.601154089 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.601972103 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.673258066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.705667019 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.706928015 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.710463047 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.711735010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.815742016 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.816510916 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.820673943 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.821338892 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.826174974 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.826261044 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.831300020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831312895 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831393003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831445932 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831584930 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831672907 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831684113 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831693888 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831720114 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831728935 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831739902 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831751108 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831769943 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831780910 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831828117 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831839085 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831856012 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831865072 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831912041 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.831923008 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832011938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832024097 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832089901 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832099915 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832110882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832119942 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832158089 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832170010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832274914 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832285881 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832321882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832333088 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832350969 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832400084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832457066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832467079 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832478046 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832503080 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832551956 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832592010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832627058 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.832645893 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.925111055 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.925115108 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:13.929955959 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:13.930182934 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.033694983 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.038098097 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.038564920 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.042994022 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.123640060 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.143068075 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.143069983 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.149084091 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.149099112 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.253123045 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.253324032 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.257957935 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.258105993 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.270421028 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.270497084 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.275362015 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.275413036 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.275423050 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.275738001 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276149988 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276171923 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276182890 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276206970 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276258945 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276268959 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276345015 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.276359081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.363701105 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.363706112 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.368563890 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.368647099 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.471178055 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.475948095 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.486757994 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.492233992 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.566565037 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.581127882 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.585988045 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.596335888 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.601207972 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.690995932 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.691092968 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.692163944 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.695961952 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.695985079 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696095943 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696106911 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696126938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696187973 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696229935 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696300030 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696321011 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696345091 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696355104 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696373940 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696443081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696461916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696577072 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696587086 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696604013 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696736097 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696746111 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696763039 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696832895 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696842909 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696860075 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696934938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696945906 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.696985006 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.697026968 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.697038889 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.705861092 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.710695982 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.800518036 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.805464029 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.814898968 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.819797039 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.909724951 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.914644957 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.924606085 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:14.929438114 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:14.986841917 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.028074980 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.032911062 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.033494949 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.070185900 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.074971914 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.143285036 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.148140907 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.174393892 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.179155111 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.183787107 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.183855057 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.190372944 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.190522909 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.190536022 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.190677881 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.190689087 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.190834045 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.190849066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.190994978 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.193856955 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.252398014 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.262115002 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.283651114 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.288620949 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.362140894 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.366995096 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.396773100 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.401684999 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.511106968 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.564795017 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.774483919 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.775451899 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.779381037 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.780200958 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.880350113 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.881794930 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.885168076 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.886524916 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.951472044 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.951560020 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.956445932 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956459045 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956479073 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956495047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956504107 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956515074 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956538916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956549883 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956568003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956578016 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956588984 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956608057 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956617117 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956625938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956671953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956681013 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.956898928 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957051039 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957117081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957226038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957326889 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957492113 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957504034 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957520962 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957530975 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957560062 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957608938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957649946 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957704067 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957715988 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957732916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957773924 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.957916975 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.987040043 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.987996101 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:15.991787910 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:15.992716074 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.096333027 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.096358061 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.101262093 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.101279974 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.205766916 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.205987930 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.210582972 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.210752964 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.251583099 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.302082062 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.315025091 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.318110943 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.319876909 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.374346018 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.384891033 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.384980917 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.389888048 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390039921 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390052080 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390084028 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390156031 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390168905 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390203953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390300989 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390372992 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390454054 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390465021 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390476942 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390511990 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390562057 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390645981 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390655994 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390685081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390803099 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390814066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390896082 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390906096 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390973091 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.390984058 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.391011953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.424631119 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.430130959 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.431174994 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.436031103 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.533854961 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.538820028 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.549518108 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.554323912 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.643258095 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.648308039 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.662091970 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.667743921 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.741214991 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.752465963 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.758083105 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.768307924 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.773199081 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.862063885 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.866947889 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.878130913 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.883152008 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.910018921 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.910125017 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.914978027 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915126085 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915143013 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915155888 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915254116 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915302038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915357113 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915396929 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915472984 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915569067 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915607929 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915616989 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915704966 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915823936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915889978 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915899992 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915942907 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915952921 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.915996075 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.916006088 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.916043043 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.916095972 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.916105986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.916147947 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.916184902 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.971242905 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.976180077 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:16.988524914 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:16.993315935 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.081254959 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.088028908 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.096257925 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.101223946 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.190149069 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.205693007 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.426717043 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.426778078 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.428648949 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.428662062 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.428735971 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.431714058 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.433573008 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.529613972 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.533606052 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.534619093 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.538430929 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.643244982 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.644176006 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.648591995 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.648893118 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.648962021 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.649107933 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.653783083 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.653832912 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.653841972 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.653867960 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.653908968 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654016018 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654025078 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654146910 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654196978 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654517889 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654546976 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654591084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654856920 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.654983044 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.655041933 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.655106068 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.655163050 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.655208111 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.658289909 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.752526045 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.752533913 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.757302046 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.757322073 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.862015963 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.863025904 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.866822004 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.867760897 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.971352100 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.971378088 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:17.976311922 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:17.976326942 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.053801060 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.082079887 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.082318068 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.086962938 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.087347984 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.123826027 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.128783941 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.128890991 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.128901958 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129149914 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129159927 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129168987 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129182100 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129221916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129266024 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129288912 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129371881 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129381895 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129420996 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129466057 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129499912 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129544020 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129569054 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129646063 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.129656076 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.189918995 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.189922094 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.194813967 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.194921017 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.300642014 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.300647020 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.305581093 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.305648088 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.409548044 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.409553051 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.414484024 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.414505959 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.518244028 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.522109985 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.523085117 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.524234056 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.527062893 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.558859110 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.563779116 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.563827991 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.563863039 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564018965 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564121008 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564193010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564244986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564300060 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564336061 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564508915 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564518929 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564640045 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564706087 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564752102 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564793110 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564845085 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564886093 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564970016 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.564980030 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.565020084 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.565028906 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.628309011 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.628320932 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.633248091 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.633265972 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.737027884 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.737946987 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.743746042 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.744553089 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.847263098 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.847261906 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.851973057 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.852291107 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.877863884 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.916757107 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.921765089 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.921907902 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.921943903 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.921988010 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922028065 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922074080 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922103882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922128916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922183037 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922243118 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922292948 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922377110 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922385931 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922396898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922460079 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.922697067 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.955988884 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.960784912 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.966363907 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:18.970283985 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:18.975236893 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.065107107 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.070022106 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.080604076 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.085412979 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.122399092 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.122509003 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.124788046 CEST	49713	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.129590988 CEST	28067	49713	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.190279961 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.195250034 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.204078913 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.252449989 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.254369020 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.259304047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259402037 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259476900 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259540081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259550095 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259583950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259633064 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259643078 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259689093 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259778023 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.259991884 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260001898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260013103 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260128021 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260138988 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260158062 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260215044 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260225058 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260313034 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260323048 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260341883 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260399103 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.260412931 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.300009966 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.346383095 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.408740997 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.413593054 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.518491983 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.523277998 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.543107986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.596024990 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.610603094 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.615696907 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.615787983 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.615863085 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.615873098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.615943909 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.615955114 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.615999937 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616039038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616144896 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616178036 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616324902 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616333961 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616385937 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616395950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616453886 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616463900 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616473913 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616514921 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616561890 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616570950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616595984 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616614103 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.616622925 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.627441883 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.674628019 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.737149954 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.742039919 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.846405029 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:19.851268053 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:19.956464052 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.077862978 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.082515955 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.083372116 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.087402105 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.120575905 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.125664949 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.125691891 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.125719070 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.125792980 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.125833988 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.125895977 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.125907898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.125968933 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126018047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126029968 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126074076 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126141071 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126152992 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126171112 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126224041 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126235962 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126255035 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126312971 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126324892 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126343966 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126430988 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126441002 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.126451969 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.176136017 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.187557936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.283673048 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.288567066 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.394100904 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.398886919 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.407608032 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.448302984 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.453310966 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.453469038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.453479052 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.453589916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.453633070 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.453777075 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.453825951 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.454102039 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.454113007 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.454150915 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.454315901 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.502417088 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.550316095 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.614135981 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.619160891 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.722089052 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.727539062 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.832098961 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.837068081 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.847634077 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.894113064 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.923099995 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:20.931730986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.931757927 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.931843042 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.931934118 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932046890 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932310104 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932318926 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932369947 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932512999 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932557106 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932627916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932714939 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932787895 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932833910 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.932914972 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933094025 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933192015 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933203936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933273077 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933334112 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933346033 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933599949 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.933610916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:20.957097054 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.010315895 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.065218925 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.070233107 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.174506903 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.179507017 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.283735991 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.289860964 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.338768005 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.391546011 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.396953106 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.396980047 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397031069 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397083044 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397320986 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397367954 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397394896 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397509098 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397519112 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397563934 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397608042 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397646904 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397700071 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397747993 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397806883 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397852898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397871971 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397907972 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.397958994 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.398006916 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.398137093 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.398188114 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.398196936 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.398262024 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.403274059 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.502517939 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.510453939 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.533874989 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.540916920 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.625744104 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.636029959 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.681279898 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.721035004 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.736290932 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.741375923 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741404057 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741457939 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741533041 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741579056 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741676092 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741744995 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741755962 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741786003 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741839886 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741852045 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741877079 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.741947889 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742013931 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742023945 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742064953 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742086887 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742110014 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742167950 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742230892 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.742331028 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.747147083 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.778973103 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.780689001 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.785481930 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.846327066 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.851140976 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:21.955671072 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:21.960572958 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.083055973 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.089693069 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.154128075 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.214129925 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.270232916 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.275338888 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275365114 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275502920 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275513887 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275523901 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275535107 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275544882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275585890 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275697947 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275707960 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275739908 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275749922 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275759935 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275809050 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275819063 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275883913 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275929928 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275939941 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.275949001 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.276046038 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.276056051 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.276066065 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.306055069 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.311359882 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.410140038 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.415111065 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.470922947 CEST	28067	49700	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.518126011 CEST	49700	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.518214941 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.525784016 CEST	28067	49708	147.185.221.18	192.168.2.6
Jul 1, 2024 16:34:22.571136951 CEST	49708	28067	192.168.2.6	147.185.221.18
Jul 1, 2024 16:34:22.571306944 CEST	49700	28067	192.168.2.6	147.185.221.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 16:33:01.303858995 CEST	64310	53	192.168.2.6	1.1.1.1
Jul 1, 2024 16:33:01.315215111 CEST	53	64310	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 16:33:01.303858995 CEST	192.168.2.6	1.1.1.1	0xe188	Standard query (0)	price-slow.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 16:33:01.315215111 CEST	1.1.1.1	192.168.2.6	0xe188	No error (0)	price-slow.gl.at.ply.gg		147.185.221.18	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:32:51
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\V6363OW8Rh.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\V6363OW8Rh.exe"
Imagebase:	0xe60000
File size:	74'240 bytes
MD5 hash:	1B5B62E15509EFCE8BB5379B28A5210B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2076708868.0000000000E62000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2981859011.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:33:06
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0x220000
File size:	74'240 bytes
MD5 hash:	1B5B62E15509EFCE8BB5379B28A5210B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\XClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:33:14
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\XClient.exe"
Imagebase:	0x4f0000
File size:	74'240 bytes
MD5 hash:	1B5B62E15509EFCE8BB5379B28A5210B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:34:21
Start date:	01/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat""
Imagebase:	0x7ff6a5c10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:34:22
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:34:22
Start date:	01/07/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff7cac00000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD348D04D8 Relevance: 5.8, Strings: 4, Instructions: 790
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=K_I, xrefs: 00007FFD348D0644
>K_, xrefs: 00007FFD348D0544
>K_^, xrefs: 00007FFD348D0601
BK_I, xrefs: 00007FFD348D0504

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID: =K_I$>K_^$>K_$BK_I
API String ID: 0-3159779337
Opcode ID: 1eeeb06aaa43188770c052eb9abdf9a59f17d041a6250f2dbd083651779bc688
Instruction ID: b0b1c8e01d5bc31393dec5ce2596e9eb819ec2cd0a6fab430c3724054b097fc2
Opcode Fuzzy Hash: 1eeeb06aaa43188770c052eb9abdf9a59f17d041a6250f2dbd083651779bc688
Instruction Fuzzy Hash: 5142C231E0E6494FEB54EBA8D8A56E9BBB0FF57314F0442BAD04CE7193DE3868458B41

Function 00007FFD348C2839 Relevance: 3.7, Strings: 2, Instructions: 1190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SAL_^, xrefs: 00007FFD348C3A01
B, xrefs: 00007FFD348C39DD

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID: B$SAL_^
API String ID: 0-405448676
Opcode ID: ffec6fc9d047ce3a028f3f9b124ad5c74f8d1b10d78e16752ca430e90202bcbf
Instruction ID: f755ddab1502bea796b6b04e885973819d0f8efe147d6a0476c4afd48708b235
Opcode Fuzzy Hash: ffec6fc9d047ce3a028f3f9b124ad5c74f8d1b10d78e16752ca430e90202bcbf
Instruction Fuzzy Hash: 7B92A770B18A098FEB98EF68C4A977DB7E2FF99305F144579D40DD3292DE38A8418B41

Function 00007FFD348D8916 Relevance: 2.4, Instructions: 2433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f91650de12e1fcd640710e2322ca9bb93e318713bf6fb04763cdf861feea65
Instruction ID: 9bb84f1281765e8b7a2c64b2fa188a60eb7e36d1055b051bab0145f5786ffac0
Opcode Fuzzy Hash: a6f91650de12e1fcd640710e2322ca9bb93e318713bf6fb04763cdf861feea65
Instruction Fuzzy Hash: F8038630A0A95D8FDB94EF68C8A5BE977F1FF5A310F0401B9D44DD3292CA39A985CB50

Function 00007FFD348C5310 Relevance: 2.4, Strings: 1, Instructions: 1110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD348CD149

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 222dcd7461b61fe583d475ed084fc5b6160334ef2775a7e2fab48665a7c8a66b
Instruction ID: b5de88a02a345b57713534611f63fb1a7446a2457e5e0ae38c4bab4e4c2cd967
Opcode Fuzzy Hash: 222dcd7461b61fe583d475ed084fc5b6160334ef2775a7e2fab48665a7c8a66b
Instruction Fuzzy Hash: 07729030F1D90A4BEB98FB7885B6679B2D2EF9A304F504579D50ED32C6DE2CAC029741

Function 00007FFD348D7EFD Relevance: 2.1, Strings: 1, Instructions: 842
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 00007FFD348D85A7

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 2f6886a629fdb76608c7cecb3416a56d83a60e6396884aa0a9b70b62a5dd8f78
Instruction ID: 97028ef945366d454aed03c6310064bdb4858be5c50e4a47a15bb749ec9f79b5
Opcode Fuzzy Hash: 2f6886a629fdb76608c7cecb3416a56d83a60e6396884aa0a9b70b62a5dd8f78
Instruction Fuzzy Hash: 00527830A0A91D8FDB94EF58D8A4BE877F1FF5A310F0405B9D45DD72A2CA39A985CB40

Function 00007FFD348C1689 Relevance: 1.8, Strings: 1, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SAL_^, xrefs: 00007FFD348C18E1

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID: SAL_^
API String ID: 0-3687847113
Opcode ID: 48f1c1a211b62eb7fa8f013e4dacf781222342fc9250c115aecadb41b123857e
Instruction ID: a8ca339be74c55ab09bdf58387a547d1074d752dcd30c294e5b71bab68c22b2a
Opcode Fuzzy Hash: 48f1c1a211b62eb7fa8f013e4dacf781222342fc9250c115aecadb41b123857e
Instruction Fuzzy Hash: 3FF1A420B19A094FEB98FBB884B9679B6D2FF9A301F440579E44DD32D6DE3DAC018741

Function 00007FFD348C1198 Relevance: 1.7, Strings: 1, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SAL_^, xrefs: 00007FFD348C18E1

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID: SAL_^
API String ID: 0-3687847113
Opcode ID: 510e572b74a5715a24567dce3b1208743d2f4924a9677df930a837855cf17fea
Instruction ID: 41ae99d0783e6bc7f091ff659dd3e2be927806ee8c109d418f394c7c131d7c7f
Opcode Fuzzy Hash: 510e572b74a5715a24567dce3b1208743d2f4924a9677df930a837855cf17fea
Instruction Fuzzy Hash: 55F1A530B29A094BEB98FB7C84B9679B2D2FF8A305F440579E44DD3296DE3CAC419741

Function 00007FFD348CE30A Relevance: 1.1, Instructions: 1095COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2615260ff704bd315d67fd1e6481b83f65392b4c2cd0f79162e6b5865658a0b
Instruction ID: 81c9ca124fb89e562d5bfcf5a3504dc74748e6dcd6805d602c30fa39c01e282a
Opcode Fuzzy Hash: b2615260ff704bd315d67fd1e6481b83f65392b4c2cd0f79162e6b5865658a0b
Instruction Fuzzy Hash: 8172A330B1CA054FE758FB6C88AA279B3D2FF99341F54467AE44DC3296DE2DBC418642

Function 00007FFD348D4A10 Relevance: .9, Instructions: 866COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1289896786ef360d850836905760b5833f6a89ec3cc24d1052ca7b8e31ab48a
Instruction ID: 0930f436cee6db8f73b808a6dca3cb21b9e47a7a89fb111ab627f4aafa1e016a
Opcode Fuzzy Hash: c1289896786ef360d850836905760b5833f6a89ec3cc24d1052ca7b8e31ab48a
Instruction Fuzzy Hash: 89523270A0A91D8FDB94EF58D895BE8B7F1FF5A311F0401BAD44DE7291CA39A881CB50

Function 00007FFD348D72F9 Relevance: .7, Instructions: 727COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84cb099482bc7db10977c307b329f46f39096c5bce910757116985333ac200b4
Instruction ID: 3e8e450d22db644bed2c26861752d96512f04f3513285e489c38be897e0ed41e
Opcode Fuzzy Hash: 84cb099482bc7db10977c307b329f46f39096c5bce910757116985333ac200b4
Instruction Fuzzy Hash: B5426570A0A91D8FDB94EB58C4A5BE8B7F1FF5A315F0041BAD04DD3296CE39A985CB40

Function 00007FFD348CC3F8 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9302fc1616077d39edbf3d7ad607a5471a65464d83420f3d19b52ff40ec572
Instruction ID: e2299cbad993bae2d252765f1e4178ecbbda71a7b0ba00c2930e0385571e63f4
Opcode Fuzzy Hash: eb9302fc1616077d39edbf3d7ad607a5471a65464d83420f3d19b52ff40ec572
Instruction Fuzzy Hash: 4B420D30E0A51D8BDBA5EB64C4A57F9B3B1FF4A305F1045BAD10EE7282CE396981DB50

Function 00007FFD348C9D72 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee1ed61798595cc7ed6b5ec3b3751fdaa44f8442bfac5e4f1be818bcb717390
Instruction ID: 85bcb4ccf02a8101c3e53ce8decf76cce9b041a6b90bb8694f23cc3eb2e9085d
Opcode Fuzzy Hash: aee1ed61798595cc7ed6b5ec3b3751fdaa44f8442bfac5e4f1be818bcb717390
Instruction Fuzzy Hash: 55E1A430A08A4E8FEBA8DF28C8657E977D1FF55310F14426EE84DC7291DF78A9458B81

Function 00007FFD348C8FF6 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b2a8f1f381ea710fcbbdd651a9980ef906c03cb2282dfc35a02de236ebab1d
Instruction ID: f981f6d5df1b8db46d832e080871aca83033593abe62ac5ef873f3a363a44b72
Opcode Fuzzy Hash: 45b2a8f1f381ea710fcbbdd651a9980ef906c03cb2282dfc35a02de236ebab1d
Instruction Fuzzy Hash: 04E17130A08A4D8FEBA8DF28C8557E977E1FF59311F04426EE84DC7691DF38A9458B81

Function 00007FFD348CD680 Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37e763f923cc1e12214cc19956133f336245c4f47918f7df9261e1d06a1a1df
Instruction ID: 8a1aeb1e98b012c5d0042dcda361536ce60961c76510a83857ff0cb3ab411053
Opcode Fuzzy Hash: b37e763f923cc1e12214cc19956133f336245c4f47918f7df9261e1d06a1a1df
Instruction Fuzzy Hash: CDB1FD2064E7C54FE743A73898A96F57FD1EF43329F0941FBE088CA0A3DA595906C752

Function 00007FFD348C1408 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1f76c5bafa2dc354ccdd09244cce553cbf7ee21bcbead31a35c881587e5b4e
Instruction ID: d27f1528b2234345b47c348b6efd8c0e8768f99d3a454e7fbfd972038507545c
Opcode Fuzzy Hash: ad1f76c5bafa2dc354ccdd09244cce553cbf7ee21bcbead31a35c881587e5b4e
Instruction Fuzzy Hash: 0A81E453F0D6864BE752ABAC59F20F9BBA1EF53361B0800B3D299D7093DD2C3C069691

Function 00007FFD348C1DFD Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b133b4e613b29e6162a1728257cf12eb8041680410ee43d7d55c940675544b0
Instruction ID: 09795d64111360a457db9df54c76b38dbf5564c3e9ae9459ac12eb2e1ba237e1
Opcode Fuzzy Hash: 6b133b4e613b29e6162a1728257cf12eb8041680410ee43d7d55c940675544b0
Instruction Fuzzy Hash: 4851F120B1D6C94FE796ABA858B5276BBD5DF9B216B0800FFE089C7293CD585C06C342

Function 00007FFD348D44CD Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ae0c2d7bf84b781dd639800879776b2cbcb690044437091c5331690cc0c517
Instruction ID: 0827b2095186c9a648516437f8f02ccd11030c6356c1124218e76c2427faad7e
Opcode Fuzzy Hash: 90ae0c2d7bf84b781dd639800879776b2cbcb690044437091c5331690cc0c517
Instruction Fuzzy Hash: 4A51C970E1991D8FDB58EF98D4A5AACB7B1FF5A305F100169D00EE7292CA35A881CF40

Function 00007FFD348D0E7D Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 150445bb379dea964049ba67714e61d98ed9fecafb9ba629fbe6405f93f67d61
Instruction ID: dc0e2bed066441523ff16476d86155eb44d10750e8fc1ce4fd0a2dc39dbaf9f7
Opcode Fuzzy Hash: 150445bb379dea964049ba67714e61d98ed9fecafb9ba629fbe6405f93f67d61
Instruction Fuzzy Hash: 6551CA70E1951D8FDB58EF98C4A5AACB7F1FF5A305F100169D009E7292CB39A881CB40

Function 00007FFD348D1DED Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a0d9cb4c7173dd4b165e12415483bbbd1ee6bd5ecc67f6ca8ebd501443db3b
Instruction ID: 0889835d2e574d625289f365dce401de58836b2feac134513e6e3d9e7cba8a96
Opcode Fuzzy Hash: 57a0d9cb4c7173dd4b165e12415483bbbd1ee6bd5ecc67f6ca8ebd501443db3b
Instruction Fuzzy Hash: 3751C970E1951D8FDB98EF58C4A5AACB7B1FF5A305F101169E44EE7292CF39A841DB00

Function 00007FFD348CF1AC Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8450c5a1831784ed1811ae606b77e40a19a00892e6b195a0d725a4befa2c6a
Instruction ID: 31af4220675f7e096bb9325996547113ab8f0f69ca69a8c7f973890fd65ecf18
Opcode Fuzzy Hash: 1a8450c5a1831784ed1811ae606b77e40a19a00892e6b195a0d725a4befa2c6a
Instruction Fuzzy Hash: 5251D970A1891D8FDF98EF68C4A5AACBBF1FF59301F10116AD41DE7296CB35A881CB40

Function 00007FFD348D3196 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b72e0f93876ecc59081faaf794ae3a4bcb878c6caa56e99eb8c60416c4cc96
Instruction ID: e552c37b335aece3aae2d675a2843f11877ffbae8fbb3c62868c20c29deac68f
Opcode Fuzzy Hash: 71b72e0f93876ecc59081faaf794ae3a4bcb878c6caa56e99eb8c60416c4cc96
Instruction Fuzzy Hash: C751A670A1991D8FDB98EF98D4A5AACB7F1FF5A301F105169E00DE7292CB35A881CB40

Function 00007FFD348C405D Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFD348C4132

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: f7b0f2a09d25050f839e66d1775a6ced3a7dac84cc97a2f4a797caad0f967097
Instruction ID: fac73e8d4e00a32d4d33e553ad2dfb01a96bda8d5c89733f4e6c566a4b8bcb2e
Opcode Fuzzy Hash: f7b0f2a09d25050f839e66d1775a6ced3a7dac84cc97a2f4a797caad0f967097
Instruction Fuzzy Hash: FD41E33190C6488FD719DFA8D859AE9BBF0FF56311F04416ED08AD3592CB786846CB91

Non-executed Functions

Function 00007FFD348C68AD Relevance: 1.6, Strings: 1, Instructions: 369COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD348C69E9

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 97403ae0b80636a0e5344c7c59bb18369e03160e3a90f0562e2dc8c3a5087817
Instruction ID: c4249f35c423b0f4784511b1f51ab3f0e99f48fbc2779eca9a850458a6450572
Opcode Fuzzy Hash: 97403ae0b80636a0e5344c7c59bb18369e03160e3a90f0562e2dc8c3a5087817
Instruction Fuzzy Hash: E2C1CF31A0CA594FDB69EBA888557E9BBB1FF56310F0442AFD04DD3292CB346945CB82

Function 00007FFD348C5888 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc2dfe30a370a41b4c0f451159df159567260d7eb4063adedd3c9ee3ed0b5cf
Instruction ID: 25193318dbf64d4570e1c0a438f993443bfeb43f1e0834f00fcb8f4cf84a04c3
Opcode Fuzzy Hash: 6bc2dfe30a370a41b4c0f451159df159567260d7eb4063adedd3c9ee3ed0b5cf
Instruction Fuzzy Hash: 53E1E531A0DA4D8FDBA8DF6898557F97BE1EF55310F04426FE44DC3292CB78A8458B81

Function 00007FFD348C8AC9 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2984452543.00007FFD348C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd348c0000_V6363OW8Rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e8a3b264e9045bba12f9f30d3797da9c72db596a33e75446bc06c663f8d00e
Instruction ID: c20b9db83fd2a87bb74143548646986925bc069cb868e6cb94872a8fe14470a8
Opcode Fuzzy Hash: d8e8a3b264e9045bba12f9f30d3797da9c72db596a33e75446bc06c663f8d00e
Instruction Fuzzy Hash: 7FD1A730A08A8D8FEBA8DF28C8557E977D1FF55311F04466EE84DC7291CB78A9458B81

Analysis Process: XClient.exePID: 2056, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD34881689 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bfbbe15093b5d69fbc2ebe97123aedf7c9091048f8a26c9a09c068ccdbf2bac
Instruction ID: 46d0987681c3651d8b4b830aba4ad9028581b4c25ebc3a7f0feef7bc25779f3d
Opcode Fuzzy Hash: 3bfbbe15093b5d69fbc2ebe97123aedf7c9091048f8a26c9a09c068ccdbf2bac
Instruction Fuzzy Hash: F5F1A270B19A094FEBD8FB7884B96B976D2FF9A300F544579E00ED32D2DE28AC419741

Function 00007FFD34881198 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46ffac923680cea0a817025623b82acfa8079ec1b14976a28bafe78bdc844ac
Instruction ID: f0e73abcd007518f34270785a480fc903496f35939019974699c783a3ca6057d
Opcode Fuzzy Hash: b46ffac923680cea0a817025623b82acfa8079ec1b14976a28bafe78bdc844ac
Instruction Fuzzy Hash: 0EF19270B28B094BEBD8EB7884B967976D2FF9E300F544579E04ED3292DE38AC419741

Function 00007FFD34881DFD Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c1724e09ef445739c637706a62a2f25ed9e44f151897066dd5e9f9cd23765e
Instruction ID: c78ce2718d85bfb13e7a1d8d031d5fd23d3b82fa06dec3a27797fd0301a176dc
Opcode Fuzzy Hash: 32c1724e09ef445739c637706a62a2f25ed9e44f151897066dd5e9f9cd23765e
Instruction Fuzzy Hash: C2510120B0D6C90FE796ABB858B52B67BD5DF9B216B0804FEE08DC7193CD585806C342

Function 00007FFD348811D1 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be08806e09eaea5813caea3263b0deb2292eada63baa6da1092eb017a86c5564
Instruction ID: edc04a8053e0cdf3f6991e181ffb668564cb98847e561f495c3b11cf0a719f65
Opcode Fuzzy Hash: be08806e09eaea5813caea3263b0deb2292eada63baa6da1092eb017a86c5564
Instruction Fuzzy Hash: FC01A2A2A0D6CA0FEB9297688C750A97FB0EF57310F4505B7C156DB2D3DE2C2C059351

Function 00007FFD34880BFE Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2aa22e660b29bd5787d00a0261784d4bbe9f78ae8e31bc387857d1f64297b42
Instruction ID: 114373e3776db16dc5beb73ad98c971dca052720958509917435e8850d1e1ae0
Opcode Fuzzy Hash: c2aa22e660b29bd5787d00a0261784d4bbe9f78ae8e31bc387857d1f64297b42
Instruction Fuzzy Hash: C8512420B4E7860FE3A7AB7848662753BE2DF97210B0900FBD48DC71A3DC5CAC428352

Function 00007FFD34880528 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b04a6705dd40e93255194855b53e66398dd561acc2d7dd755f6c0f76d29fda
Instruction ID: 71be0dde71c68a14fd8788cdf3dd6b366db5c9212b269a39e6c6902b45b1268d
Opcode Fuzzy Hash: 45b04a6705dd40e93255194855b53e66398dd561acc2d7dd755f6c0f76d29fda
Instruction Fuzzy Hash: E631B521B1C9490FE7E8EB6C94AA779B6C6EF9D315F0405BEE44EC3293DD68AC418341

Function 00007FFD34880A91 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd993b16dc198bf7893666149524ea0234a28551bfa7cbc8cb00e8bf4c011eb
Instruction ID: 8c3b45f4526163f53ec0127f0773676a8b4d9ada989032d05f4c87bfb7595000
Opcode Fuzzy Hash: 9dd993b16dc198bf7893666149524ea0234a28551bfa7cbc8cb00e8bf4c011eb
Instruction Fuzzy Hash: 9B31B461B18A4A4FF794BBEC48693BE67D5EF9A311F05027AE00DC32D3ED2C68018391

Function 00007FFD34880949 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253300457.00007FFD34880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34880000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf7ee7da665cb0d151c47859534c4e55bb6616e98d2a6ef42bd565beb04b279
Instruction ID: 43731372c3bd1341a9f9408080c80eeb79195d0f97a827ae55ce5b8367d191b4
Opcode Fuzzy Hash: dcf7ee7da665cb0d151c47859534c4e55bb6616e98d2a6ef42bd565beb04b279
Instruction Fuzzy Hash: 7E318374B1864E4FEB58EBA8C8756EE7BB1FF99300F640579D009D3282CE39A8418791

Analysis Process: XClient.exePID: 2812, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD34891689 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d16151e6089f77a83eee793c31593f0913b9463891961ed336924d23a5880e9
Instruction ID: 5ffaa458579b99f96832bb46ff04cdc86640d2772b3cdbc13c4851a9dd49d387
Opcode Fuzzy Hash: 2d16151e6089f77a83eee793c31593f0913b9463891961ed336924d23a5880e9
Instruction Fuzzy Hash: EFF18271B1CE0A4FEB94FB7884B96B97AD2FF9A300F444579E00DD3292DE39A8419741

Function 00007FFD34891198 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4e8aaf2c4c5f66602bc3f54c2ce0a029249ebf79c10d9aff38c8523262a57c
Instruction ID: 14ec2aa0c879dcf7cfcecd784062bdeb578d5e91bb0c420c28e93100f5123a5b
Opcode Fuzzy Hash: 9b4e8aaf2c4c5f66602bc3f54c2ce0a029249ebf79c10d9aff38c8523262a57c
Instruction Fuzzy Hash: 87F1A371B2CE0A4BEB94EB7C84B92797AD2FF9D300F444579E04ED3292DE39A8419741

Function 00007FFD34891DFD Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe698be57dda9cb6ed135664b018c6e1670baaeb508315b00bd762361dc3618
Instruction ID: a93817e2d839e29a40b90696c670c5e2ffdeafc842b861f34cb0be5eb6e59c0a
Opcode Fuzzy Hash: ebe698be57dda9cb6ed135664b018c6e1670baaeb508315b00bd762361dc3618
Instruction Fuzzy Hash: 6A510321B1DAC90FE796AB7858B527A7FD5DF9B216B0804FEE08DC7193CD585806C342

Function 00007FFD348911D1 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99477c9a8ba77762eed1ac8c171008c74ad9c83353f079c18569018cc125dc38
Instruction ID: 3d3bbc010ddaad4024ea2482cffacc5724791fb33e70104927e9219ac528b766
Opcode Fuzzy Hash: 99477c9a8ba77762eed1ac8c171008c74ad9c83353f079c18569018cc125dc38
Instruction Fuzzy Hash: 1D316F72A0C94A4FEB85EBA8D8B11FD7FB1FF96310F450177C11AE7292CE2868058750

Function 00007FFD34890BFE Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4ead9ddd7f1b525ef4ec5de38bb43375685b7b51d506087de2f1c14fdb0ed6
Instruction ID: b4efe086bc926de6eeb2f7139b8d7a5b43f3ae02c15c2b964247d300d11823fb
Opcode Fuzzy Hash: 6f4ead9ddd7f1b525ef4ec5de38bb43375685b7b51d506087de2f1c14fdb0ed6
Instruction Fuzzy Hash: 9251F521B1EA860FE3A7A77848662753FE2DF87211B0900FBD48DC7293DC5C5C468352

Function 00007FFD34890528 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5832c43f8c4389e6ef3b7e4be9227b0df6a3b946fa44099ca302bc93e31b54
Instruction ID: 7c120b2b80cfd2d022ed9946050ea61c2f057dbaedb1bfa17f47bb65f5b6cec2
Opcode Fuzzy Hash: 9e5832c43f8c4389e6ef3b7e4be9227b0df6a3b946fa44099ca302bc93e31b54
Instruction Fuzzy Hash: 9231A621B1C9490FF798EB6C94AA779A6C2EFDD316F0405BEE04EC3293DD68AC418341

Function 00007FFD34890A91 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c656a23b0f70cf1807f1d84fbd43e63465730afe141d5a91a1178d8505d7cb1
Instruction ID: 02bfd7762a74f97cfc637c629acd377adf29b75e3e64fac644ac1f57b6b1f6c3
Opcode Fuzzy Hash: 2c656a23b0f70cf1807f1d84fbd43e63465730afe141d5a91a1178d8505d7cb1
Instruction Fuzzy Hash: C3318361B18D4A4FF794ABAC58793BEA7D6EF99711F14017AE00DC32D3EE2868418391

Function 00007FFD34890949 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2333686235.00007FFD34890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34890000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093d72b33a4dc434d3047ff55c367733f4a767eca05d71bbabb9da5bb922dc81
Instruction ID: 94d976a7eab78b8861033e8fb9dcd77f030023ba62ab45320a70885a8838c97a
Opcode Fuzzy Hash: 093d72b33a4dc434d3047ff55c367733f4a767eca05d71bbabb9da5bb922dc81
Instruction Fuzzy Hash: F7319F35B18A4E4FEB55EBB8C4756EA7BB1FF99300F540579D009E3282CE3968518790

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report V6363OW8Rh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\V6363OW8Rh.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

C:\Users\user\AppData\Roaming\XClient.exe

\Device\Null

Static File Info

General

File Icon

Windows Analysis Report
V6363OW8Rh.exe

Function 00007FFD348D04D8 Relevance: 5.8, Strings: 4, Instructions: 790
COMMON

Function 00007FFD348C2839 Relevance: 3.7, Strings: 2, Instructions: 1190
COMMON

Function 00007FFD348D8916 Relevance: 2.4, Instructions: 2433
COMMON

Function 00007FFD348C5310 Relevance: 2.4, Strings: 1, Instructions: 1110
COMMON

Function 00007FFD348D7EFD Relevance: 2.1, Strings: 1, Instructions: 842
COMMON

Function 00007FFD348C1689 Relevance: 1.8, Strings: 1, Instructions: 502
COMMON

Function 00007FFD348C1198 Relevance: 1.7, Strings: 1, Instructions: 497
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre